External risk intelligence

Everest Forms PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-3296

The vulnerability exists in a WordPress form plugin that processes input from public-facing web forms. Because these forms are designed to be embedded on public websites to collect user submissions, the vulnerable entry point is exposed to the internet by default for any site utilizing the plugin.

Deserialization

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the Everest Forms WordPress plugin that could allow unauthenticated attackers to inject malicious code by submitting specially crafted data through public forms. The issue arises from the plugin's handling of form entry data, specifically when an administrator views submitted entries, potentially leading to compromise of the affected WordPress site.

Attackers can inject harmful code via public forms.
Plugin vulnerability allows remote code execution.
Confirm relevance and exposure for your WordPress sites.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by submitting specially crafted data through a public form, which is then stored by the WordPress plugin. When an administrator views the submitted entries, the plugin processes this malicious data insecurely, potentially leading to arbitrary code execution.

Unauthenticated access to a public form.
Submitting malicious serialized data via a form.
Remote code execution risk.

Live Threat

Current exploitation, exposure, and threat context

PHP Object Injection in the Everest Forms plugin could allow unauthenticated attackers to inject malicious serialized PHP objects through public form fields. When an administrator views form entries, these objects are deserialized without proper restrictions, potentially leading to a compromise of the WordPress site.

WordPress site data and behavior.
Unserialized PHP objects via public forms.
Full site compromise may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Everest Forms plugin's PHP Object Injection vulnerability requires immediate attention from the WordPress site administrators and the platform or infrastructure teams responsible for the underlying WordPress deployment. The primary action is to locate all instances of the affected plugin, confirm their exposure to the internet, and identify the business criticality of each deployment to prioritize remediation efforts.

WordPress administrators and platform owners
Verify affected WordPress deployments
Coordinate vendor update or mitigation

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Everest Forms plugin?

Everest Forms is a popular plugin for the WordPress content management system designed to let site owners create and manage custom contact, registration, and data-gathering forms. It allows users to build these forms using a drag-and-drop interface, which are then embedded onto web pages to collect submissions from visitors directly into the site's database.

What does PHP Object Injection mean for CVE-2026-3296?

This vulnerability, classified as CWE-502, occurs when the plugin takes data submitted by a user and reconstructs it as a PHP object without verifying the content. Because the code trusts this input implicitly, an attacker can provide a specially crafted object that forces the server to execute unintended commands or manipulate site behavior when an administrator opens the form entries dashboard.

How does an attacker trigger this vulnerability?

An attacker triggers the issue by submitting malicious serialized data through any public-facing Everest Forms field. The bug is not triggered by simply visiting a page; it requires a successful form submission that saves the crafted data into the database. The vulnerability only executes once a site administrator navigates to the plugin's entries view, causing the application to process the stored malicious payload.

Is my site at risk based on Halo Surface Signal?

Yes, your site is at high risk if you use the affected plugin versions. According to Halo Surface Signal, because Everest Forms is designed to collect data from public web forms, the entry point is exposed to the internet by default. If your site hosts these forms, an unauthenticated user on the internet can reach the vulnerable code path without needing specific access credentials.

What should I do to secure my WordPress site?

The primary step is to identify all WordPress instances running vulnerable versions of Everest Forms. Once identified, prioritize updating the plugin to the latest version that contains the security patches. If you cannot update immediately, consider disabling public-facing forms to prevent new malicious data from being stored in your database until the fix is applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.