Is CVE-2026-3296 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3296 being exploited in the wild.

How severe is CVE-2026-3296?

Critical severity, with a CVSS score of 9.8, published 8 April 2026.

Which products and versions are affected?

WPEverest Everest Forms up to, and including, 3.4.3.

Is there a fix for CVE-2026-3296?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-3296 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-3296?

Check whether you run WPEverest Everest Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3296: WPEverest Everest Forms PHP Object Injection in form entry metadata

CVE-2026-3296 · Severity: critical · CVSS 9.8 · Published 2026-04-08

Everest Forms, a popular WordPress plugin used for creating contact and payment forms, contains a critical security flaw. An attacker can submit malicious data through any public form on a website, which is then stored in the site's database. When a site administrator later views these form submissions, the malicious data is automatically processed, potentially allowing the attacker to take full control of the website or delete sensitive information.

Technologies: WPEverest Everest Forms. Vendors: WPEverest.

Quick answers

Is CVE-2026-3296 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3296 being exploited in the wild.
How severe is CVE-2026-3296?: Critical severity, with a CVSS score of 9.8, published 8 April 2026.
Which products and versions are affected?: WPEverest Everest Forms up to, and including, 3.4.3.
Is there a fix for CVE-2026-3296?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-3296 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-3296?: Check whether you run WPEverest Everest Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Everest Forms plugin is vulnerable to PHP Object Injection via the 'unserialize()' function in the 'html-admin-page-entries-view.php' file. The vulnerability occurs because the plugin fails to use the 'allowed_classes' parameter when deserializing stored entry metadata. An unauthenticated attacker can submit a serialized PHP object through any public form field; this payload bypasses 'sanitize_text_field()' because serialization control characters are not stripped. The payload is stored in the 'wp_evf_entrymeta' table and is executed when an administrator views the entries in the WordPress dashboard. If a suitable POP chain is present on the server, this can lead to remote code execution or arbitrary file deletion. The issue is fixed in version 3.4.4.

Affected products

WPEverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder up to, and including, 3.4.3

Timeline

2026-04-08: disclosed: Initial publication of the vulnerability advisory.
2026-04-08: advisory: Wordfence published detailed vulnerability information.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.