CVE-2026-3296
CVE-2026-3296 is a critical PHP Object Injection vulnerability in the Everest Forms WordPress plugin affecting all versions up to 3.4.3. Unauthenticated attackers can inject malicious serialized PHP objects through form fields that get stored in the database and later deserialized unsafely when an administrator views form entries, potentially leading to remote code execution.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress site administrators using the Everest Forms plugin versions 3.4.3 or earlier. Note: No affected products were listed in the CPE data provided.
Real-world impact
An unauthenticated attacker can exploit this vulnerability by submitting a malicious payload through any public form using Everest Forms. When an administrator views the form entries, the malicious serialized object is deserialized without restrictions, potentially allowing the attacker to execute arbitrary code on the server with the privileges of the web application.
Why this severity
This vulnerability receives a critical severity rating of 9.8 (CVSS 3.1) because it requires no authentication, no user interaction, and can lead to complete compromise of confidentiality, integrity, and availability. The attack complexity is low, making exploitation straightforward for attackers.
What to do about it
- ›Immediately disable or remove the Everest Forms plugin if not actively used
- ›If the plugin is required, restrict access to forms by implementing authentication requirements before form submission
- ›Monitor the Everest Forms plugin page for updates and apply patches immediately when available
- ›Consider using a web application firewall (WAF) to detect and block suspicious serialized object payloads
- ›Review all existing form entries for suspicious serialized data patterns
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No official fix documented in sources. NVD description indicates vulnerability exists in all versions up to 3.4.3, but no patch or update is referenced in the provided data.
Timeline
- Apr 8, 2026 · Apr 8, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 25, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.