What is the CVSS score of CVE-2026-3296?

CVE-2026-3296 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-3296?

Everest Forms for WordPress (versions ≤3.4.3) contains a critical PHP object injection vulnerability allowing unauthenticated attackers to execute arbitrary code on affected websites when…

Is there a public PoC exploit available for CVE-2026-3296?

Yes, a public proof-of-concept exploit is available for CVE-2026-3296. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-3296?

Within 24 hours: Identify all WordPress instances running Everest Forms ≤3.4.3 using plugin inventory tools; temporarily disable the plugin if upgrade cannot be completed immediately. Within 7 days: Upgrade all affected installations to Everest Forms version 3.4.4 or later. Within 30 days: Conduct security audit of form submissions received while vulnerable; review administrator access logs for suspicious activity during the vulnerability window; implement Web Application Firewall rules to block serialized PHP payloads in form submissions.

PHP CVE-2026-3296

EUVD-2026-20020 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-04-08 Wordfence

WordPress PHP Deserialization Everest Forms Contact Form Payment Form Quiz Survey Custom Form Builder

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 01:45 euvd

EUVD-2026-20020

Analysis Generated

Apr 08, 2026 - 01:45 vuln.today

CVE Published

Apr 08, 2026 - 01:24 nvd

CRITICAL 9.8

DescriptionCVE.org

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize() on stored entry meta values without passing the allowed_classes parameter. This makes it possible for unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload survives sanitize_text_field() sanitization (serialization control characters are not stripped) and is stored in the wp_evf_entrymeta database table. When an administrator views entries or views an individual entry, the unsafe unserialize() call processes the stored data without class restrictions.

AnalysisAI

PHP object injection in Everest Forms for WordPress (all versions ≤3.4.3) allows unauthenticated remote attackers to achieve critical system compromise. Attackers submit malicious serialized payloads through any public form field, which persist through sanitization into the wp_evf_entrymeta database table. When administrators view form entries, unsafe unserialize() without class restrictions processes the payload, enabling arbitrary code execution. CVSS 9.8 (Critical) reflects network-accessible

Technical ContextAI

This vulnerability exploits PHP's unserialize() function, a known attack surface for object injection (CWE-502). The affected code path in html-admin-page-entries-view.php deserializes user-controlled data from form entry metadata without the allowed_classes parameter, which would restrict instantiation to safe classes. PHP object injection occurs when attackers craft serialized objects containing magic methods (__wakeup, __destruct, __toString) that trigger automatically during deserialization. If WordPress or installed plugins/themes contain POP (Property-Oriented Programming) chains-classes with exploitable magic methods-attackers can chain these together to achieve arbitrary code execution, file operations, or database manipulation. The vulnerability's critical severity stems from the attack surface (any public-facing Everest Forms instance) and the trigger mechanism (administrator viewing entries, a routine administrative action). Everest Forms is a WordPress contact/payment form builder plugin (cpe:2.3:a:wpeverest:everest_forms), making this vulnerability accessible on any WordPress site using the plugin with public forms.

RemediationAI

Immediately upgrade to Everest Forms version 3.4.4 or later, which addresses the unsafe deserialization vulnerability as documented in the changelog at https://plugins.trac.wordpress.org/changeset/3489938/everest-forms/tags/3.4.4/readme.txt. The patch modifies the deserialization logic to implement safe handling of entry metadata, visible in the code differences between version 3.4.3 and 3.4.4 at https://plugins.trac.wordpress.org/changeset?old_path=/everest-forms/tags/3.4.3&new_path=/everest-forms/tags/3.4.4. Site administrators should update through the WordPress admin dashboard (Plugins > Updates) or via WP-CLI using 'wp plugin update everest-forms'. If immediate patching is not feasible, temporary risk reduction measures include restricting form entry viewing to only essential administrators (reduces trigger surface), implementing Web Application Firewall rules to detect serialized object patterns in form submissions (though determined attackers can obfuscate payloads), and monitoring the wp_evf_entrymeta database table for suspicious serialized data patterns. However, these workarounds do not eliminate the vulnerability and patching remains the only complete remediation.