The vulnerability allows unauthenticated attackers to inject a PHP object through deserialization of untrusted data in the mime_content_type() function when a form contains an optional signature field and an image upload field. The injection alone does not provide a payload, but it can be leveraged if another plugin or theme supplies a PHP Object Persistence (POP) chain, enabling deletion of files, data disclosure, or code execution. The flaw is limited to PHP versions earlier than 8, so modern PHP installations are not affected.

The affected product is Everest Forms Pro, available from WPEverest, with all releases up to and including version 1.9.7 vulnerable. The flaw manifests only when the plugin is installed on a WordPress site containing a form that has an optional signature field and an image upload field.

The CVSS score is 5.6, indicating a moderate severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires unauthenticated access to the vulnerable form; no known exploit has been publicly documented. If a POP chain exists on the site, the attacker could achieve significant impact, but without such a chain the risk is comparatively low.