FKIE_CVE-2025-1128

Vulnerability from fkie_nvd - Published: 2025-02-25 07:15 - Updated: 2025-02-28 15:59
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server which may make remote code execution, sensitive information disclosure, or a site takeover possible.
References
security@wordfence.comhttps://github.com/wpeverest/everest-forms/commit/7d37858d2c614aa107b0f495fe50819a3867e7f5Patch
security@wordfence.comhttps://github.com/wpeverest/everest-forms/pull/1406/filesPatch
security@wordfence.comhttps://plugins.trac.wordpress.org/changeset/3237831/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php#file0Patch
security@wordfence.comhttps://plugins.trac.wordpress.org/changeset/3243663/everest-forms#file7Patch
security@wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/8c04d8c9-acad-4832-aa8a-8372c58a0387?source=cveThird Party Advisory
Impacted products
Vendor Product Version
wpeverest everest_forms *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wpeverest:everest_forms:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "B712653D-F559-40E4-818F-C6F329618214",
              "versionEndExcluding": "3.0.9.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Everest Forms \u2013 Contact Forms, Quiz, Survey, Newsletter \u0026 Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the \u0027format\u0027 method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site\u0027s server which may make remote code execution, sensitive information disclosure, or a site takeover possible."
    },
    {
      "lang": "es",
      "value": "El complemento Everest Forms \u2013 Contact Forms, Quiz, Survey, Newsletter \u0026amp; Payment Form Builder para WordPress es vulnerable a la carga, lectura y eliminaci\u00f3n de archivos arbitrarios debido a la falta de validaci\u00f3n de tipo y ruta de archivo en el m\u00e9todo \u0027format\u0027 de la clase EVF_Form_Fields_Upload en todas las versiones hasta la 3.0.9.4 incluida. Esto hace posible que atacantes no autenticados carguen, lean y eliminen archivos arbitrarios en el servidor del sitio afectado, lo que puede hacer posible la ejecuci\u00f3n remota de c\u00f3digo, la divulgaci\u00f3n de informaci\u00f3n confidencial o la toma de control del sitio."
    }
  ],
  "id": "CVE-2025-1128",
  "lastModified": "2025-02-28T15:59:40.317",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "security@wordfence.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-02-25T07:15:18.480",
  "references": [
    {
      "source": "security@wordfence.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/wpeverest/everest-forms/commit/7d37858d2c614aa107b0f495fe50819a3867e7f5"
    },
    {
      "source": "security@wordfence.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/wpeverest/everest-forms/pull/1406/files"
    },
    {
      "source": "security@wordfence.com",
      "tags": [
        "Patch"
      ],
      "url": "https://plugins.trac.wordpress.org/changeset/3237831/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php#file0"
    },
    {
      "source": "security@wordfence.com",
      "tags": [
        "Patch"
      ],
      "url": "https://plugins.trac.wordpress.org/changeset/3243663/everest-forms#file7"
    },
    {
      "source": "security@wordfence.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8c04d8c9-acad-4832-aa8a-8372c58a0387?source=cve"
    }
  ],
  "sourceIdentifier": "security@wordfence.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "security@wordfence.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.