CVE-2026-3296 Details

A vulnerability allowing PHP object injection has been identified in the Everest Forms plugin for WordPress, affecting all versions through 3.4.3. The issue arises from the plugin's 'html-admin-page-entries-view.php' file, which deserializes untrusted input from form entry metadata using PHP's native 'unserialize()' function. This deserialization occurs without proper safeguards, allowing unauthenticated attackers to inject serialized PHP object payloads through public form fields. The injected payloads bypass 'sanitize_text_field()' sanitization, as serialization control characters are not removed, and are stored in the 'wp_evf_entrymeta' database table. When an administrator accesses the entries, the deserialized data is processed without any class restrictions, potentially leading to malicious object injection exploitation.

Users are advised to update the Everest Forms plugin to version 3.4.4 or later, where this vulnerability has been patched.