CVE-2025-1128

Katalog CVE

CVSS 9.8 · Critical EPSS 28,8%

Kerentanan Unrestricted Upload of File with Dangerous Type pada wpeverest everest forms. Skor CVSS 3.1 9.8 (Critical) menurut wordfence.com.

Deskripsi (NVD)

The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the EVF_Form_Fields_Upload class in all versions up to, and including, 3.0.9.4. This makes it possible for unauthenticated attackers to upload, read, and delete arbitrary files on the affected site's server which may make remote code execution, sensitive information disclosure, or a site takeover possible.

Rincian

Terbit di NVD

25 Februari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

28,8% peluang dieksploitasi; lebih tinggi dari 98,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wpeverest/everest-forms/commit/7d37858d2c614aa107b0f495fe50819a3867e7f5 patch
• https://github.com/wpeverest/everest-forms/pull/1406/files patch
• https://plugins.trac.wordpress.org/changeset/3237831/everest-forms/trunk/includes/abstracts/class-evf-form-fie... patch
• https://plugins.trac.wordpress.org/changeset/3243663/everest-forms#file7 patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8c04d8c9-acad-4832-aa8a-8372c58a0387?source=cve advisory pihak ketiga