CVE-2026-3296
PHP Object Injection in Everest Forms Plugin Allows Remote Exploitation
Publication date: 2026-04-08
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| everest_forms | everest_forms | to 3.4.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Everest Forms plugin for WordPress has a vulnerability called PHP Object Injection in all versions up to and including 3.4.3. This happens because the plugin unserializes data from form entry metadata without restricting which classes can be instantiated. Attackers can inject malicious serialized PHP objects through any public form field, bypassing sanitization, and these objects are stored in the database. When an administrator views the entries, the unsafe unserialize() function processes this data, potentially leading to exploitation.
How can this vulnerability impact me? :
This vulnerability has a very high severity score (CVSS 9.8) and can be exploited remotely without authentication. It can lead to complete compromise of the affected WordPress site because attackers can execute arbitrary PHP code by injecting malicious objects. This can result in full control over the site, data theft, defacement, or further attacks on the hosting environment.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to inject malicious serialized PHP objects into form entry metadata, which can lead to full compromise of confidentiality, integrity, and availability of the affected system.
Such a high-severity vulnerability (CVSS 9.8) impacting data confidentiality and integrity could result in violations of data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and tampering.
Therefore, organizations using the Everest Forms plugin without patching this vulnerability risk non-compliance with these common standards and regulations due to potential data breaches and unauthorized data manipulation.