What the vulnerability does
01Description
The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize() on stored entry meta values without passing the allowed_classes parameter. This makes it possible for unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload survives sanitize_text_field() sanitization (serialization control characters are not stripped) and is stored in the wp_evf_entrymeta database table. When an administrator views entries or views an individual entry, the unsafe unserialize() call processes the stored data without class restrictions.
Explanation of Vulnerability in Simple Terms
02Summary
Everest Forms versions up to 3.4.3 contain a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code on the site. The plugin unsafely deserializes untrusted data, enabling remote code execution without requiring user interaction or special network conditions. All sites running affected versions should update immediately.
What an attacker can do
03Attacker Capabilities
Run their own PHP code on the site and take complete control of it.
Potential impact on your site
04Site Impact
Complete site compromise: attackers can steal data, modify content, install malware, or delete everything.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 8, 2026
CVE published
April 8, 2026
Record updated
