PHP Object Injection Vulnerability in Everest Forms Plugin for WordPress

CVE-2026-3296

What is CVE-2026-3296?

The Everest Forms plugin for WordPress is susceptible to a PHP Object Injection flaw that affects all versions up to 3.4.3. This vulnerability arises from the deserialization of untrusted input, specifically when the html-admin-page-entries-view.php file calls PHP's native unserialize() function on entry metadata. Affected instances may allow unauthenticated attackers to inject a malicious serialized PHP object payload through any public Everest Forms form field. Despite sanitization efforts using sanitize_text_field(), serialization control characters remain intact, allowing for the payload's persistence in the wp_evf_entrymeta database table. When administrators attempt to view the entries or an individual entry, the insecure unserialize() operation processes the stored data without any class restrictions, leading to potential exploitation.

References