The vulnerability allows an attacker to inject a serialized PHP object via any public form field in the Everest Forms plugin. The stored entry metadata is unserialized without class restrictions when an administrator views entries, enabling arbitrary code execution. The object survives WordPress sanitization, so the attack does not require authentication to submit the payload. Successful exploitation can compromise confidentiality, integrity, and availability of the affected WordPress site.

WordPress installations running the Everest Forms plugin (wpeverest:Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder) with version 3.4.3 or earlier are affected. No other products or versions are listed as vulnerable.

The CVSS score of 9.8 marks the issue as critical, with no EPSS data available. It is not listed in the CISA KEV catalogue. The attack vector is likely from a public form that an unauthenticated user can submit data to the site. The prerequisite for exploitation is that an attacker can retain a crafted serialized payload; the exploit is triggered only when an administrator later accesses the entry view, at which point the unserialize call processes the malicious data. Given the high severity and the potential for full code execution on the host, the risk is high and the likelihood of exploitation is significant in environments where the plugin is not upgraded.