PT-2025-45066 · WordPress · Everest Forms+1

Alex Thomas · Published 2025-11-05 · Updated 2025-11-05 · CVE-2025-8871

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Everest Forms (Pro) versions up to and including 1.9.7

Description The Everest Forms (Pro) plugin for WordPress is susceptible to PHP Object Injection due to deserialization of untrusted input within the mime content type() function. This allows unauthenticated attackers to inject a PHP Object when a form with a non-required signature field and an image upload field is present on the site. The impact of this issue is limited unless another plugin or theme containing a PHP Object Payload (POP) chain is installed. If a POP chain exists on the system, an attacker could potentially delete files, retrieve sensitive data, or execute code. This vulnerability is exploitable in PHP versions prior to 8.

Recommendations Versions prior to 1.9.8 are affected. Update to a version greater than 1.9.7.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-8871

Affected Products

Everest Forms

Wordpress

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-8871 · Security Note
• https://t.me/cveNotify/141760 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/11d45287-f875-4cc9-aaf6-47158fe32858?source=cve · Note
• https://t.me/CVEtracker/36577 · Telegram Post
• https://everestforms.net/changelog · Note