The vulnerability in the Everest Forms plugin permits PHP Object Injection through deserialization of data from the 'field_value' parameter. An attacker can craft malicious serialized objects, causing the plugin to instantiate arbitrary PHP objects on the server. Because no native POP chain exists within the plugin, the direct exploit surface is limited; however, if the target site also runs another plugin or theme that implements a PHP Object Property (POP) chain, the injected objects can trigger destructive or exfiltrating actions such as deleting files, reading sensitive data, or executing arbitrary code, contingent on the chain.

The affected product is the Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder WordPress plugin, currently vulnerable in all versions up to and including 3.1.1. Sites running these versions should consider the plugin version number when assessing risk.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of 4% suggests a non‑negligible likelihood of exploitation in the wild. The flaw is accessible without authentication, implying the attack vector is through publicly reachable HTTP requests. Although not listed in the CISA KEV catalog, the potential for remote code execution depends on additional software installed on the host; sites without a compatible POP chain remain less exposed, but the presence of such a chain considerably raises the risk.