A critical vulnerability in Everest Forms, a WordPress form-building plugin used on more than 100,000 sites, was disclosed on August 24 with a maximum-severity CVSS score of 9.8. Tracked as CVE-2026-19598, the flaw lives in the plugin's file-upload handling code, specifically the class that processes form-submitted uploads. Because the plugin fails to properly validate file types and file paths, an attacker who has never logged in and holds no WordPress account can submit a specially crafted request through any public-facing form that uses the upload field and drop a PHP web shell directly onto the server. Once that shell is in place, the attacker effectively owns the site: they can read the wp-config.php file to steal database credentials, create new administrator accounts, rewrite themes and plugins, and inject malicious JavaScript that runs in every visitor's browser. The bug also opens a path to arbitrary file deletion, an attacker could remove wp-config.php itself, which knocks the site back into WordPress's first-run installation screen and lets them repoint it at a database they control, effectively hijacking the whole installation. For teams that build or maintain WordPress sites, this is a reminder that contact-form and survey plugins are a disproportionately common attack surface because they are specifically designed to accept untrusted input, including file uploads, from anonymous visitors. Everest Forms shipped a fix in version 3.0.9.5; anyone running an older version should update immediately, and if immediate patching is not possible, temporarily disabling the plugin, especially any public upload-enabled forms, is the safer stopgap. Site owners should also treat this as an incident-response trigger, not just a patch reminder: check for unfamiliar admin accounts, scan the uploads directory for newly created PHP files, and review server logs for suspicious requests aimed at the plugin's upload endpoints, since exploitation requires no authentication and is trivial to automate at scale.