CVE-2026-3296 - Vulnerability Analysis

Overview

Everest Forms WordPress plugin <= 3.4.3 contains a PHP Object Injection caused by unsafe unserialize() of form entry metadata in html-admin-page-entries-view.php, letting unauthenticated attackers execute arbitrary code, exploit requires administrator to view entries.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary PHP code when an administrator views malicious form entries, potentially leading to full site compromise.

Mitigation

Update to the latest version beyond 3.4.3.

References

• https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/admin/views/html-admin-page-entries-view.php#L133
• https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/evf-core-functions.php#L5594
• https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/admin/views/html-admin-page-entries-view.php#L133
• https://plugins.trac.wordpress.org/changeset/3489938/everest-forms/tags/3.4.4/readme.txt?old=3464753&old_path=everest-forms%2Ftags%2F3.4.3%2Freadme.txt
• https://plugins.trac.wordpress.org/changeset?old_path=/everest-forms/tags/3.4.3&new_path=/everest-forms/tags/3.4.4
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2693ae37-790d-4b18-a9ec-054c8c27b8bc?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner