EUVD-2026-76214
GHSA-cw9x-3jm8-25rg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Everest Forms <=3.6.0
-
DeliveryCraft serialized PHP object payload
-
ExploitSubmit to unauthenticated form endpoint
-
ExecutionPayload passed to unserialize()
-
PersistGadget chain magic method executes
-
ImpactRCE or file/database compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated access to a site running Everest Forms <= 3.6.0 with an input path that reaches unserialize() (CVSS AV:N/AC:L/PR:N/UI:N confirms network, low-complexity, no auth, no user interaction). The critical limiting factor is that meaningful impact (RCE/file/DB compromise) requires a usable POP gadget chain present in the plugin, an active theme, or WordPress core; without a reachable chain the object injection is largely inert. No specific non-default configuration is required beyond having the vulnerable plugin active. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects a worst-case, network-reachable, no-auth, no-interaction full-impact scenario, which is the standard ceiling Patchstack assigns to unauthenticated object injection. However, that ceiling is contingent: without a usable POP gadget chain reachable from the plugin/theme/core in a given installation, the practical impact is far lower. No EPSS score, KEV status, or POC was supplied, so there is no evidence of active or automated exploitation - treat 9.8 as the theoretical maximum and prioritize based on the plugin's wide deployment plus the ease of the injection vector (unauthenticated, low complexity) rather than confirmed weaponization. |
| Exploit ScenarioDerived | An attacker submits a crafted request to an Everest Forms endpoint containing a serialized PHP object string in an unauthenticated form field. When the plugin deserializes it, a magic method in an installed gadget chain fires, allowing the attacker to read/write files, tamper with the database, or execute code as the web server user. No public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 11, 2026
Unauthenticated PHP Object Injection affects the Everest Forms WordPress plugin (wpeverest) in all versions up to and including 3.6.0, allowing remote attackers to pass attacker-controlled serialized data into a PHP unserialize() call. If a suitable POP (property-oriented programming) gadget chain is present in the plugin, an installed theme, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis, and no EPSS or KEV signal was provided.
RemediationAI
Upgrade Everest Forms to a version later than 3.6.0 once the vendor publishes a fixed release; the supplied data does not name an exact patched version, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/everest-forms/vulnerability/wordpress-everest-forms-plugin-3-6-0-php-object-injection-vulnerability) for the fixed build. No vendor-released patch version is confirmed in the provided data. As interim compensating controls: deactivate the Everest Forms plugin until patched (removes the vulnerable endpoint but disables all forms), place a WAF/virtual patch in front of the site to block serialized-object payloads reaching the plugin's form-submission handlers, and audit installed plugins/themes to reduce available gadget chains (reduces the odds injection escalates to RCE but does not close the injection itself).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Everest Forms is a popular WordPress form-builder plugin (CPE cpe:2.3:a:wpeverest:everest_forms). The root cause is CWE-502 Deserialization of Untrusted Data: an unauthenticated input path feeds attacker-supplied data into PHP's unserialize(), letting the attacker instantiate arbitrary PHP objects with controlled properties. Object injection is not directly exploitable by itself - its real-world impact depends on a reachable 'magic method' gadget chain (e.g., __wakeup, __destruct, __toString) in loaded code that performs a dangerous action when the crafted object is created or destroyed. The tags PHP and Deserialization correctly describe the mechanism.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated and network-reachable, but full impact requires a reachable POP gadget chain, which raises attack complexity to AC:H versus the vendor's AC:L.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
Executive ViewAI
Organizations running Everest Forms WordPress plugin (version 3.6.0 or earlier) face critical exposure to remote code execution and data compromise, as the plugin contains a vulnerability exploitable by any internet user without authentication. With no vendor patch currently available, each affected website becomes an active risk for account takeover, sensitive data theft, and operational disruption.
No vendor-released patch identified at time of analysis. Implement WAF blocking rules for the vulnerable plugin endpoints, deploy file integrity monitoring on WordPress upload directories to detect post-compromise modifications, restrict form submission to authenticated users via IP allowlist or authentication proxy where operationally feasible, and enable detailed logging on form submission requests to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB