CVE-2026-3296

🗓️ 08 Apr 2026 01:24:43Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 64 Views🌐 WEB

Everest Forms up to 3.4.3 allows unauthenticated PHP object injection via entry metadata unserialize.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for CVE-2026-3296	26 May 202606:33	–	githubexploit
Circl	CVE-2026-3296	8 Apr 202603:16	–	circl
CNNVD	WordPress plugin Everest Forms 代码问题漏洞	8 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-3296 Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata	8 Apr 202601:24	–	cvelist
EUVD	EUVD-2026-20020	8 Apr 202601:24	–	euvd
Nuclei	Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection	5 Aug 202602:59	–	nuclei
NVD	CVE-2026-3296	8 Apr 202602:16	–	nvd
Patchstack	WordPress Everest Forms plugin <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata vulnerability	8 Apr 202606:58	–	patchstack
Positive Technologies	PT-2026-31067	8 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-3296	5 Jun 202619:21	–	redhatcve

Vulners

Node

wpeverest everest_forms_contact_form,_payment_form,_quiz,_survey_&_custom_form_builderRange≤3.4.3wordpress

[
  {
    "vendor": "wpeverest",
    "product": "Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.4.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/admin/views/html-admin-page-entries-view.php
plugins	www.plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/evf-core-functions.php
plugins	www.plugins.trac.wordpress.org/changeset/3489938/everest-forms/tags/3.4.4/readme.txt
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/2693ae37-790d-4b18-a9ec-054c8c27b8bc
plugins	www.plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/admin/views/html-admin-page-entries-view.php

Parameter	Position	Path	Description	CWE
everest_forms[id]	request body	contact/	Unauthenticated injection via malformed serialized payload in form field data stored for an entry, leading to unserialize() during admin viewing.	CWE-502
everest_forms[form_fields][text_xyz]	request body	contact/	Unauthenticated injection via malformed serialized payload in form field data stored for an entry, leading to unserialize() during admin viewing.	CWE-502
_wpnonce123	request body	contact/	Unauthenticated injection via malformed serialized payload in form field data stored for an entry, leading to unserialize() during admin viewing.	CWE-502
page	query param	wp-admin/admin.php	Admin panel loads and unserializes stored entry metadata when viewing an entry, enabling PHP object injection if crafted payloads are present in entry metadata.	CWE-502
form_id	query param	wp-admin/admin.php	Admin panel loads and unserializes stored entry metadata when viewing an entry, enabling PHP object injection if crafted payloads are present in entry metadata.	CWE-502
view-entry	query param	wp-admin/admin.php	Admin panel loads and unserializes stored entry metadata when viewing an entry, enabling PHP object injection if crafted payloads are present in entry metadata.	CWE-502

25 Jul 2026 10:10Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.8

EPSS0.03469

SSVC