CVE-2026-3296: 
WordPress vulnerability analysis and mitigation

CVE-2026-3296 is a PHP Object Injection vulnerability in the Everest Forms plugin for WordPress, affecting all versions up to and including 3.4.3. The flaw allows unauthenticated remote attackers to inject serialized PHP object payloads through any public form field, which are later deserialized unsafely when an administrator views form entries. It was published on April 8, 2026, with a patch released in version 3.4.4. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Wordfence).

The root cause is CWE-502 (Deserialization of Untrusted Data): the file html-admin-page-entries-view.php calls PHP's native unserialize() on stored form entry meta values without specifying the allowed_classes parameter, removing any class-level restriction on deserialized objects. Attackers submit a crafted serialized PHP object payload via any public Everest Forms form field; the payload bypasses sanitize_text_field() sanitization because serialization control characters are not stripped, and the malicious data is persisted in the wp_evf_entrymeta database table. The unsafe unserialize() call is triggered when an administrator navigates to view form entries or an individual entry, executing the attacker's payload in the server context. A public PoC repository has been identified at https://github.com/xxconi/CVE-2026-3296 (GitHub Advisory, Wordfence).

Successful exploitation enables unauthenticated attackers to achieve remote code execution with full server-level access, triggered when an administrator views form entries — requiring no direct interaction from the attacker beyond submitting a form. The impact spans all three security pillars: full confidentiality loss (access to WordPress database credentials, user data, and server files), full integrity loss (ability to modify or delete site content and data), and full availability loss (potential to crash or disable the WordPress installation). The attack can originate from any network source and may facilitate complete compromise of the WordPress environment, including lateral movement to other hosted applications or infrastructure (Wordfence, GitHub Advisory).

As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and no public proof-of-concept exploit was initially available at disclosure; however, a PoC repository (https://github.com/xxconi/CVE-2026-3296) has since appeared. The EPSS score is approximately 0.02–0.037%, placing it in a low-to-moderate exploitation probability range. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE. The vulnerability is detected by Qualys (detection ID 531128) (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Everest Forms plugin (versions ≤ 3.4.3) using tools like WPScan, Shodan, or by inspecting page source for Everest Forms indicators (e.g., evf- CSS classes or form action URLs).
2. Locate a public form: Navigate to any publicly accessible page on the target site that contains an Everest Forms form field (contact form, survey, etc.).
3. Craft a malicious payload: Construct a serialized PHP object payload targeting a gadget chain available in the WordPress/plugin environment (e.g., using tools like PHPGGC to generate a chain that achieves code execution or file write).
4. Inject the payload: Submit the serialized payload as a form field value. Because sanitize_text_field() does not strip serialization control characters, the payload is stored as-is in the wp_evf_entrymeta database table.
5. Trigger deserialization: Wait for (or social-engineer) an administrator to view the form entries in the WordPress admin panel (WP Admin > Everest Forms > Entries). When the admin loads the entries view, html-admin-page-entries-view.php calls unserialize() on the stored meta value without class restrictions, executing the gadget chain.
6. Achieve objective: Depending on the gadget chain used, the attacker may achieve remote code execution, write a web shell, exfiltrate data, or escalate privileges on the server (GitHub Advisory, Wordfence).

• Database: Suspicious serialized PHP object strings (beginning with O:, a:, s:, C:) stored in the wp_evf_entrymeta table's meta_value column, particularly in fields that should contain plain text user input.
• File System: Unexpected PHP files (web shells) created in the WordPress uploads directory, plugin directories, or theme directories; modification timestamps on core files inconsistent with plugin update history.
• Logs: WordPress/PHP error logs showing unserialize() warnings or fatal errors related to unknown class instantiation; web server access logs showing POST requests to Everest Forms submission endpoints followed by admin-panel GET requests to entries views.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker process (e.g., bash, curl, wget, python, nc) shortly after an administrator accesses the entries view.
• Network: Unexpected outbound connections from the web server to external IPs or domains following administrator access to the Everest Forms entries page (Wordfence, GitHub Advisory).

The vendor (WPEverest) released a patch in Everest Forms version 3.4.4, which addresses the unsafe unserialize() call in html-admin-page-entries-view.php. All sites running version 3.4.3 or earlier should immediately upgrade to 3.4.4 or later via the WordPress plugin dashboard or by downloading from the WordPress plugin repository. If immediate patching is not possible, restrict access to the WordPress admin entries view to only trusted administrators, consider temporarily disabling the Everest Forms plugin, and monitor the wp_evf_entrymeta database table for suspicious serialized object entries (GitHub Advisory, Wordfence).

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for April 6–12, 2026, highlighting it as a critical issue requiring immediate patching (Wordfence Blog). Sucuri also covered the vulnerability in their April 2026 vulnerability patch roundup (Sucuri Blog). The CISA included it in their weekly vulnerability bulletin (SB26-103) for the week of April 6, 2026 (CISA Bulletin). Community discussion was noted on Bluesky and various vulnerability tracking platforms shortly after disclosure.