The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.4.3. The vulnerability is caused by unserializing untrusted entry metadata without class restrictions, allowing an unauthenticated attacker to submit a crafted serialized PHP object through any public form field. The payload survives WordPress sanitization and is stored in the wp_evf_entrymeta table. When an administrator views an entry, the unsafe unserialize() call processes the malicious data, giving the attacker the ability to execute arbitrary code on the server. The impact is full compromise of confidentiality, integrity, and availability of the affected WordPress site.

WordPress installations running the Everest Forms plugin (wpeverest:Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder) with version 3.4.3 or earlier are affected. No other products or versions are listed as vulnerable.

The CVSS score of 9.8 marks the issue as critical, and the EPSS score of 3% indicates a low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalogue. The attack vector is likely from a public form that an unauthenticated user can submit data to the site. The prerequisite for exploitation is that the attacker can store a crafted serialized payload; the exploit is triggered only when an administrator later accesses the entry view, at which point the unserialize call processes the malicious data. Given the high severity and the potential for full code execution on the host, the risk is high and the likelihood of exploitation is significant in environments where the plugin is not upgraded.