Other entities may exploit a deserialization flaw in the Everest Forms - Frontend Listing WordPress plugin. The vulnerability allows an attacker to inject arbitrary PHP objects during deserialization of untrusted data, which can lead to remote code execution or other uncontrolled behavior. The weakness is classified as CWE‑502 (Deserialization of Untrusted Data).

The flaw exists in the Everest Forms - Frontend Listing plugin provided by wpeverest, affecting all installations running version 1.0.5 or earlier.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1% suggests that active exploitation in the wild is currently unlikely. As the issue has not been listed in the CISA KEV catalog, it is not currently known to be actively exploited at scale. The attack vector is inferred to be through the plugin’s frontend interface, where untrusted input is deserialized without proper validation. If the plugin is exposed to public submission forms, an attacker could craft a request that injects malicious objects. Successful exploitation would give the attacker the full capabilities of the WordPress environment, potentially allowing code execution, data exfiltration, or site defacement.