CVE-2026-3296

{"id": "CVE-2026-3296", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3296", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-08T14:21:41.571035Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "wpeverest", "product": "Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Custom Form Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.4.3"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-08T02:16:04.067", "references": [{"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/admin/views/html-admin-page-entries-view.php#L133", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/evf-core-functions.php#L5594", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/admin/views/html-admin-page-entries-view.php#L133", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3489938/everest-forms/tags/3.4.4/readme.txt?old=3464753&old_path=everest-forms%2Ftags%2F3.4.3%2Freadme.txt", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=/everest-forms/tags/3.4.3&new_path=/everest-forms/tags/3.4.4", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2693ae37-790d-4b18-a9ec-054c8c27b8bc?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize() on stored entry meta values without passing the allowed_classes parameter. This makes it possible for unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload survives sanitize_text_field() sanitization (serialization control characters are not stripped) and is stored in the wp_evf_entrymeta database table. When an administrator views entries or views an individual entry, the unsafe unserialize() call processes the stored data without class restrictions."}, {"lang": "es", "value": "El plugin Everest Forms para WordPress es vulnerable a la inyecci\u00f3n de objetos PHP en todas las versiones hasta la 3.4.3, inclusive, a trav\u00e9s de la deserializaci\u00f3n de entrada no confiable de los metadatos de entrada de formulario. Esto se debe a que el archivo html-admin-page-entries-view.php llama a la funci\u00f3n nativa unserialize() de PHP en los valores meta de entrada almacenados sin pasar el par\u00e1metro allowed_classes. Esto hace posible que atacantes no autenticados inyecten una carga \u00fatil de objeto PHP serializado a trav\u00e9s de cualquier campo de formulario p\u00fablico de Everest Forms. La carga \u00fatil sobrevive a la sanitizaci\u00f3n de sanitize_text_field() (los caracteres de control de serializaci\u00f3n no se eliminan) y se almacena en la tabla de la base de datos wp_evf_entrymeta. Cuando un administrador ve las entradas o ve una entrada individual, la llamada insegura a unserialize() procesa los datos almacenados sin restricciones de clase."}], "lastModified": "2026-07-25T10:10:00.167", "sourceIdentifier": "security@wordfence.com"}