PT-2026-31067 · WordPress · Everest Forms

Published 2026-04-08 · Updated 2026-05-18 · CVE-2026-3296

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Everest Forms plugin for WordPress versions up to and including 3.4.3

Description The Everest Forms plugin for WordPress is susceptible to PHP Object Injection due to the unsafe deserialization of untrusted input from form entry metadata. The html-admin-page-entries-view.php file uses PHP's unserialize() function on stored entry meta values without specifying allowed classes. This allows unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload is stored in the wp evf entrymeta database table and processed when an administrator views entries. The sanitize text field() function does not strip serialization control characters, allowing the payload to survive sanitization.

Recommendations Update the Everest Forms plugin to a version later than 3.4.3.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-3296

Affected Products

Everest Forms

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2026-3296 · Security Note
• https://twitter.com/SirajD_Official/status/2056241995832856969 · Twitter Post
• https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/admin/views/html-admin-page-entries-view.php#L133 · Note
• https://plugins.trac.wordpress.org/changeset?old_path=/everest-forms/tags/3.4.3&new_path=/everest-forms/tags/3.4.4 · Note
• https://twitter.com/autumn_good_35/status/2041852713395482974 · Twitter Post
• https://twitter.com/OrizonCyber/status/2041727756476518896 · Twitter Post
• https://twitter.com/CveFindCom/status/2041707961119084734 · Twitter Post
• https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/evf-core-functions.php#L5594 · Note
• https://twitter.com/CVEarity/status/2041808728731873655 · Twitter Post
• https://twitter.com/0dayPublishing/status/2041692385709527134 · Twitter Post
• https://t.me/cveNotify/158401 · Telegram Post
• https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/admin/views/html-admin-page-entries-view.php#L133 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2693ae37-790d-4b18-a9ec-054c8c27b8bc?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3489938/everest-forms/tags/3.4.4/readme.txt?old=3464753&old_path=everest-forms%2Ftags%2F3.4.3%2Freadme.txt · Note
• https://twitter.com/CVEnew/status/2041711819866456095 · Twitter Post