PatchSiren cyber security CVE debrief
CVE-2026-3296 wpeverest CVE debrief
The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize() on stored entry meta values without passing the allowed_classes parameter. This vulnerability allows unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload survives sanitize_text_field() sanitization (serialization control characters are not stripped) and is stored in the wp_evf_entrymeta database table. When an administrator views entries or views an individual entry, the unsafe unserialize() call processes the stored data without class restrictions.
- Vendor
- wpeverest
- Product
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
- CVSS
- CRITICAL 9.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-04-08
- Original CVE updated
- 2026-07-25
- Advisory published
- 2026-04-08
- Advisory updated
- 2026-07-25
Who should care
Administrators and users of the Everest Forms plugin for WordPress should be aware of this vulnerability and take immediate action to update to a patched version. This vulnerability is particularly concerning for those who use the Everest Forms plugin in their WordPress deployments, as it could allow attackers to inject malicious PHP objects. Users should review their current version and update as necessary.
Technical summary
The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection due to the deserialization of untrusted input from form entry metadata in the html-admin-page-entries-view.php file. This file calls PHP's native unserialize() on stored entry meta values without passing the allowed_classes parameter, allowing unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The vulnerability exists in all versions up to, and including, 3.4.3 of the plugin.
Defensive priority
High
Recommended defensive actions
- Update to a patched version of the Everest Forms plugin
- Review and sanitize all form entry metadata
- Monitor for suspicious activity
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
- Review compensating controls for exposed systems while remediation is scheduled and verified.
Evidence notes
The CVE record was published on 2026-04-08T02:16:04.067Z and was last modified on 2026-07-25T10:10:00.167Z. The NVD entry is currently Deferred. This vulnerability affects the Everest Forms plugin for WordPress, specifically versions up to and including 3.4.3. The vulnerability allows for PHP Object Injection through deserialization of untrusted input from form entry metadata. The html-admin-page-entries-view.php file calls PHP's native unserialize() on stored entry meta values without passing the allowed_classes parameter. This makes it possible for unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload survives sanitize_text_field() sanitization and is stored in the wp_evf_entrymeta database table.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T02:16:04.067Z and has not been modified since then. The NVD entry is currently Deferred.