PHP Object Injection Vulnerability in Everest Forms Plugin for WordPress by WPEverest

CVE-2025-3439

Summary

The Everest Forms plugin for WordPress, up to version 3.1.1, contains a PHP Object Injection vulnerability due to improper handling of untrusted input from the 'field_value' parameter. This issue allows unauthenticated attackers to potentially inject a PHP object. While no known PHP Object Protocol (POP) chain exists in the vulnerable software, the exploitation risks amplify if a compatible POP chain is present through another plugin or theme. Under such circumstances, attackers could delete arbitrary files, access sensitive data, or execute malicious code, thereby posing significant security threats to WordPress sites using this plugin.

References