CVE-2025-5927

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability requires an admin to trigger the deletion via deletion of a form entry and cannot be carried out by the attacker alone.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-36

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-592703.1psPAS PowerShell module does not explicitly enforce TLS 1.2 within the 'Get-PASSAMLResponse' function during the SAML authentication processCVE-2025-592718.7Redis Enterprise Elevation of Privilege VulnerabilityCVE-2025-592729.3Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform inCVE-2025-592739.8Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.CVE-2025-592757.8Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locallyCVE-2025-592777.8Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locallyCVE-2025-592787.8Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locallyCVE-2025-59284.3The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, CVE-2025-592803.1Improper authentication in Windows SMB Client allows an unauthorized attacker to perform tampering over a network.CVE-2025-592817.8Improper link resolution before file access ('link following') in XBox Gaming Services allows an authorized attacker to elevate privileges lCVE-2025-592827.0Concurrent execution using shared resource with improper synchronization ('race condition') in Inbox COM Objects allows an unauthorized attaCVE-2025-592845.5Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally.