Description

Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T19:17:43.207Z",
  "pubdate": "2026-09-11T19:17:43.207Z",
  "executiveSummary": "A critical security vulnerability identified as Unauthenticated PHP Object Injection exists in Everest Forms versions 3.6.0 and below.\nThis vulnerability allows unauthenticated remote attackers to inject serialized PHP objects into the application via insufficiently sanitized user input.\nBy manipulating the object state, an attacker can trigger unintended code execution paths, potentially leading to arbitrary code execution (ACE), remote code execution (RCE), or denial of service within the WordPress environment.\nThe flaw stems from the insecure deserialization of untrusted data processed by the plugin. Exploitation requires no prior authentication, significantly increasing the risk to affected WordPress sites.\nSuccessful exploitation grants an attacker the capability to execute malicious code with the privileges of the web server process, leading to a complete compromise of the underlying application, site data, and potentially the server environment.\nImmediate action is required to mitigate this risk, as this vulnerability is exploitable over a network without user interaction.",
  "technicalDetails": "The vulnerability resides in the way Everest Forms handles incoming data streams, specifically within components that utilize PHP's unserialize() function on user-supplied input without proper validation or integrity checks.\nThe root cause is the unsafe deserialization of untrusted input, which permits the instantiation of arbitrary PHP classes that are already loaded in the application scope (POP - Property Oriented Programming).\nAn attacker can exploit this by crafting a malicious serialized string containing a chain of gadget classes present within the plugin or the WordPress core/environment. When the vulnerable component calls unserialize() on this payload, the PHP engine reconstructs the object, triggering magic methods such as __destruct(), __wakeup(), or __toString() within the gadget classes.\nThe attack flow begins with the attacker identifying an exposed endpoint within the Everest Forms plugin that accepts user input—often via POST parameters or serialized configuration data—that is subsequently passed to a deserialization routine.\nBy chaining these gadgets, an attacker can manipulate class properties to achieve unintended behavior, such as writing arbitrary files to the server, executing system commands, or performing unauthorized database queries.\nBecause the vulnerability is unauthenticated, it can be exploited remotely by sending a specifically crafted HTTP request to the vulnerable endpoint. There are no privilege requirements, and the attack does not require any existing user session.\nPost-exploitation impact includes full system compromise, data exfiltration, modification of plugin configurations, and persistent access to the server via web shells or backdoored PHP files.\nThe vulnerable component remains active in all versions of Everest Forms <= 3.6.0, as these versions fail to implement adequate object filtering or validation mechanisms before deserializing input data."
}