External risk intelligence

Everest Forms Frontend Listing Object Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-60210

This is a vulnerability in a WordPress plugin designed for frontend listing and form functionality. Such plugins are explicitly intended to be accessed by public web users, making the vulnerable code directly reachable via the internet as part of the normal operation of a public-facing website.

Deserialization

Wpeverest Everest Forms Frontend Listing

1.0.5 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the Everest Forms Frontend Listing component, a WordPress plugin that allows for the display of form data. This flaw, related to how the plugin handles data input, could potentially enable attackers to inject malicious code, impacting the confidentiality, integrity, and availability of systems. The primary concern is confirming if this plugin is in use and if it is exposed to external access.

Untrusted data can be maliciously manipulated.
Critical plugin flaw could be widely exploited.
Confirm relevance and exposure of this component.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a website using the vulnerable Everest Forms - Frontend Listing plugin. This allows them to inject malicious code through the plugin's data handling, potentially leading to complete control over the affected website.

No special access is needed.
Untrusted data is deserialized.
Risk of complete site compromise.

Live Threat

Current exploitation, exposure, and threat context

This deserialization vulnerability in the Everest Forms - Frontend Listing plugin could allow an attacker to inject malicious objects into the system when the plugin is used in specific supported conditions. This could potentially affect the integrity and availability of the website's backend and data.

System data and configuration.
Remote unauthenticated code execution.
Website compromise and data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The real-world impact of this vulnerability is likely within the domain of website owners and their support teams, potentially involving application owners, infrastructure, or platform teams responsible for WordPress site management. The immediate priority is to identify all instances of the affected plugin, assess their exposure to the internet, and determine business criticality to prioritize remediation efforts. Coordination with any vendor-management teams for the WordPress ecosystem may also be necessary.

Website owners should own this issue.
Verify public accessibility and business criticality.
Plan remediation based on exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Everest Forms - Frontend Listing plugin used for?

This software is a WordPress plugin designed to help site administrators display form submissions or data directly on the public-facing areas of a website. It functions as a bridge between the backend form data and the user interface, allowing visitors to see listed information without needing administrative access.

What does deserialization of untrusted data mean in CVE-2025-60210?

This is a weakness known as CWE-502, or Object Injection. It occurs when the plugin takes data from a user and reconstructs it into a programming object without proper verification. Because the plugin trusts this input, an attacker can supply a specially crafted object that forces the system to execute unintended actions or malicious code.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by sending a specifically formatted request to the website that interacts with the plugin's data-handling features. It does not require the attacker to have pre-existing credentials or special permissions on the site. Simply navigating to or interacting with parts of the site that process this input can be enough to initiate the attack.

Is my website at risk from this vulnerability?

According to Halo Surface Signal, this plugin is intended for frontend use, meaning it is designed to be reachable by internet users. If your site uses versions 1.0.5 or earlier, it is likely exposed because the plugin's code is directly accessible to the public as part of its normal operation.

What should I do first to address this security risk?

Start by auditing your WordPress environment to identify if this specific plugin is installed. Once located, evaluate how critical the plugin is to your site's functionality. If you do not need the plugin, remove it immediately. If it is required, keep it disabled until you can update to a secure version or apply vendor-provided security patches.

References

patchstack.com/database/Wordpress/Plugin/everest-forms-frontend-list…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.