CVE Intelligence
Analysis AI-assisted

CVE-2026-3296: Everest Forms WordPress Plugin – PHP Object Injection

CVE-2026-3296 is a critical PHP Object Injection flaw in the Everest Forms plugin for WordPress, affecting all versions up to and including 3.4.3. According to the record, unauthenticated attackers can submit serialized data through public form fields, and that data is later processed by an unsafe deserialization call when an administrator views form entries. Wordfence rates it 9.8 (CVSS 3.1), and the record shows no KEV listing, so site owners should review their plugin version and restrict access to entry data.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-3296 affects the Everest Forms plugin for WordPress. The record describes unsafe deserialization of entry metadata that can be reached through public forms without authentication.

Impact

  • Wordfence rates the issue Critical, with a CVSS 3.1 base score of 9.8 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • The record classifies the weakness as CWE-502, Deserialization of Untrusted Data.
  • The consequences of PHP Object Injection depend on the classes available in the application. The record does not describe a specific resulting impact, so this remains unknown.

Affected products and versions

  • Product: Everest Forms plugin for WordPress.
  • Range described: all versions up to and including 3.4.3.
  • The structured affected and fixes lists in the record are empty.
  • A changeset reference points to the 3.4.4 tag. The record does not explicitly confirm that this release fixes the issue.

Exploitation status

  • The record shows kev.listed as false, so this analysis does not state active exploitation.
  • No confirmed exploitation appears in the sources consulted.
  • The record reports an EPSS probability of 0.02977 and a percentile of 0.86937.

Remediation and mitigation

  • Check the installed Everest Forms version and plan an update to a release newer than 3.4.3, confirming the release notes in the plugin repository.
  • Until the update is applied, limit who can access the Everest Forms entries screens and restrict administrator sessions to trusted users.
  • Review whether public forms accept unnecessary input and reduce exposure where possible.
  • Test the update in a staging environment before rolling it out to production.

Detection guidance

  • Review web server and application logs for unusual submissions to public Everest Forms forms that contain serialized-looking content.
  • Inspect the wp_evf_entrymeta table for entries with unexpected serialized data, as a high-level check.
  • Monitor administrator activity on entries screens for unexpected behavior.

Limitations of the available information

  • Structured affected and fixed version data is not provided in the record.
  • The record does not describe which PHP classes exist on target sites or the resulting effect of processing.
  • The record contains an EPSS date of 2026-10-13 that should be checked against its source before reliance.
  • This analysis used only the record data; the linked external advisories were not verified.

Frequently asked questions

Is CVE-2026-3296 being actively exploited?

The record shows kev.listed as false, so this analysis does not state active exploitation. No confirmed exploitation appears in the sources consulted.

Which Everest Forms versions are affected?

The description states that all versions up to and including 3.4.3 are affected. The structured affected versions list in the record is empty.

What should site administrators do now?

Check the installed Everest Forms version, plan an update to a release newer than 3.4.3 after confirming its release notes, and restrict access to the entries screens until the update is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.