CVE-2026-3296: Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize() on stored entry meta values without passing the allowedclasses parameter. This makes it possible for unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload survives sanitizetextfield() sanitization (serialization control characters are not stripped) and is stored in the wpevfentrymeta database table. When an administrator views entries or views an individual entry, the unsafe unserialize() call processes the stored data without class restrictions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3296?
CVE-2026-3296 has a high severity rating due to the potential for PHP Object Injection that can lead to remote code execution.
How do I fix CVE-2026-3296?
To fix CVE-2026-3296, update the Everest Forms plugin to the latest version that is above 3.4.3.
Who is affected by CVE-2026-3296?
All users of the Everest Forms plugin for WordPress versions up to and including 3.4.3 are affected by CVE-2026-3296.
What type of vulnerability is CVE-2026-3296?
CVE-2026-3296 is classified as a PHP Object Injection vulnerability due to unsafe deserialization of user input.
Can CVE-2026-3296 be exploited without authentication?
Yes, CVE-2026-3296 can be exploited without authentication, allowing an attacker to inject malicious objects.