CVE-2026-115483

Name of the Vulnerable Software and Affected Versions Everest Forms versions prior to 3.6.4

Description An Arbitrary File Read issue exists via the attach entry files() function. The function attaches any entry field value with a meta key matching /signature / to the notification email after performing only a file exists() check, without validating or restricting the path. This allows unauthenticated attackers to read arbitrary server files, such as wp-config.php. Exploitation requires the Everest Forms Pro add-on, a form with the Attach Files setting enabled, a field with a meta key matching /signature /, and the notification routed to an attacker-controlled email address.

Recommendations Update to version 3.6.4 or later. As a temporary workaround, restrict the use of the attach entry files() function or disable the Attach Files setting in email notifications.