CVE-2026-3296

🗓️ 08 Apr 2026 01:24:43Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 89 Views🌐 WEB

Everest Forms up to 3.4.3 allows unauthenticated PHP object injection via entry metadata unserialize.

Reporter	Title	Published	Views	Family All 13
GithubExploit	Exploit for CVE-2026-3296	26 May 202606:33	–	githubexploit
Circl	CVE-2026-3296	8 Apr 202603:16	–	circl
CNNVD	WordPress plugin Everest Forms 代码问题漏洞	8 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-3296 Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata	8 Apr 202601:24	–	cvelist
EUVD	EUVD-2026-20020	8 Apr 202601:24	–	euvd
Kitploit	CVE-2026-3296	15 Sep 202614:23	–	kitploit
Nuclei	Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection	16 Sep 202602:04	–	nuclei
NVD	CVE-2026-3296	8 Apr 202602:16	–	nvd
Patchstack	WordPress Everest Forms plugin <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata vulnerability	8 Apr 202606:58	–	patchstack
Positive Technologies	PT-2026-31067	8 Apr 202600:00	–	ptsecurity

Vulners

Node

wpeverest everest_formsRange≤3.4.3wordpress

[
  {
    "vendor": "wpeverest",
    "product": "Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.4.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/admin/views/html-admin-page-entries-view.php
plugins	www.plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/evf-core-functions.php
plugins	www.plugins.trac.wordpress.org/changeset/3489938/everest-forms/tags/3.4.4/readme.txt
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/2693ae37-790d-4b18-a9ec-054c8c27b8bc
plugins	www.plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/admin/views/html-admin-page-entries-view.php

Parameter	Position	Path	Description	CWE
everest_forms[id]	request body	contact/	Unauthenticated payload can be injected via a public Everest Forms field; deserialization occurs on admin view leading to PHP Object Injection (CVE-2026-3296).	CWE-502
everest_forms[form_fields][text_xyz]	request body	contact/	Unauthenticated payload can be injected via a public Everest Forms field; deserialization occurs on admin view leading to PHP Object Injection (CVE-2026-3296).	CWE-502
_wpnonce123	request body	contact/	Unauthenticated payload can be injected via a public Everest Forms field; deserialization occurs on admin view leading to PHP Object Injection (CVE-2026-3296).	CWE-502
page	query param	wp-admin/admin.php	Admin page loads entry data which can trigger unserialize() on stored meta, enabling gadget chain execution after payload has been stored (phase for triggering).	CWE-502
form_id	query param	wp-admin/admin.php	Admin page loads entry data which can trigger unserialize() on stored meta, enabling gadget chain execution after payload has been stored (phase for triggering).	CWE-502
view-entry	query param	wp-admin/admin.php	Admin page loads entry data which can trigger unserialize() on stored meta, enabling gadget chain execution after payload has been stored (phase for triggering).	CWE-502

25 Jul 2026 10:10Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.8

EPSS0.03469

SSVC