CVE-2026-115483

The Everest Forms plugin for WordPress (versions up to and including 3.6.3 ) is vulnerable to an Unauthenticated Arbitrary File Read via the attach_entry_files() function. The root cause is that the function attaches any entry field value whose meta key matches /signature_/ to notification emails...