Everest Forms Frontend Listing
Monthly
PHP Object Injection in the Everest Forms - Frontend Listing WordPress plugin (versions through 1.0.5) lets unauthenticated remote attackers feed attacker-controlled data into a PHP unserialize() sink, potentially triggering arbitrary object instantiation on the target site. The CVSS base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) per the reporter, while our independent assessment keeps the same scope of impact but raises attack complexity to High (AC:H) because a working exploitation path depends on an exploitable POP gadget chain being present in the plugin, Everest Forms core, or another active plugin or theme. EPSS is low at 0.50% (41st percentile), there is no KEV listing, and no public exploit code has been identified at time of analysis.
PHP Object Injection in the Everest Forms - Frontend Listing WordPress plugin (versions through 1.0.5) lets unauthenticated remote attackers feed attacker-controlled data into a PHP unserialize() sink, potentially triggering arbitrary object instantiation on the target site. The CVSS base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) per the reporter, while our independent assessment keeps the same scope of impact but raises attack complexity to High (AC:H) because a working exploitation path depends on an exploitable POP gadget chain being present in the plugin, Everest Forms core, or another active plugin or theme. EPSS is low at 0.50% (41st percentile), there is no KEV listing, and no public exploit code has been identified at time of analysis.