PT-2025-27115 · Unknown · Everest Forms

Published 2025-06-27 · Updated 2025-09-13 · CVE-2025-52709

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Everest Forms versions through 3.2.2

Description: Deserialization of untrusted data in Everest Forms allows for object injection. This issue impacts installations with PHP versions below 7.1, potentially leading to remote code execution (RCE) when an administrator views form submissions. It is estimated that over 100,000 sites are affected.

Recommendations: Update to version 3.2.3.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-52709

Affected Products

Everest Forms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-52709 · Security Note
• https://twitter.com/CVEnew/status/1938575528925200486 · Twitter Post
• https://twitter.com/fridaysecurity/status/1953256306212512057 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1953291668783771692 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/everest-forms/vulnerability/wordpress-everest-forms-3-2-2-php-object-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/Komodosec/status/1966926400369352860 · Twitter Post
• https://t.me/pentestingnews/65884 · Telegram Post