Description
Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
Published: 2026-09-11
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an unauthenticated PHP Object injection in Everest Forms plugin versions up to 3.6.0. Attackers can send specially crafted serialized objects to trigger arbitrary object creation and code execution, potentially allowing full compromise of the hosted WordPress site.

Affected Systems

WordPress sites that have the Everest Forms plugin installed with a version 3.6.0 or earlier are affected. Any instance of the plugin without the update to 3.6.1 or later remains vulnerable.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is < 1%, but the lack of a C legitimate high exploitation risk, especially since the flaw is unauthenticated and can be triggered via crafted HTTP requests to the plugin’s endpoints. Remediation is urgent due to the simplicity of the injection payloads and the remote code execution potential.

Generated by OpenCVE AI on September 21, 2026 at 03:56 UTC.

Remediation

Vendor Solution

Update the WordPress Everest Forms Plugin to the latest available version (at least 3.6.1).

OpenCVE Recommended Actions

  • Upgrade the Everest Forms plugin to version 3.6.1 for the site.
  • If the plugin is no longer needed, deactivate and delete it to prevent any accidental exposure to malicious POST requests.
  • Configure a web application firewall to reject HTTP requests that contain PHP serialized objects by inspecting payloads for common serialization patterns.

Generated by OpenCVE AI on September 21, 2026 at 03:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 13 Sep 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpeverest
Wpeverest everest Forms
Vendors & Products Wordpress
Wordpress wordpress
Wpeverest
Wpeverest everest Forms

Sat, 12 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
Title WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Wordpress Wordpress
Wpeverest Everest Forms
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-09-11T20:19:11.777Z

Reserved: 2026-07-13T06:15:10.221Z

Link: CVE-2026-62103

cve-icon Vulnrichment

Updated: 2026-09-11T20:13:08.489Z

cve-icon NVD

Status : Deferred

Published: 2026-09-11T19:17:43.207

Modified: 2026-09-11T21:17:11.897

Link: CVE-2026-62103

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T04:00:13Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data