What is CVE-2026-3296?

CVE-2026-3296 is a critical-severity vulnerability in Wpeverest Everest Forms – Contact Form, Payment Quiz, Survey & Custom Form Builder, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2026-04-08.

How severe is CVE-2026-3296?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2026-3296 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Deserialization in Wpeverest Everest Forms – Contact Form, Payment Quiz, Survey & Custom Form Builder

CVE-2026-3296

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize() on stored entry meta values without passing the allowed_classes parameter. This makes it possible for unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload survives sanitize_text_field() sanitization (serialization control characters are not stripped) and is stored in the wp_evf_entrymeta database table. When an administrator views entries or views an individual entry, the unsafe unserialize() call processes the stored data without class restrictions.

Vulnerability class: Insecure Deserialization

Published 2026-04-08 · last modified 2026-07-25.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.030 (86.7th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 86.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.035 · newest: 0.030 · change: -0.005

Affected products

Wpeverest Everest Forms – Contact Form, Payment Quiz, Survey & Custom Form Builder — versions 0

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

Public proof-of-concept exploits

xxconi/CVE-2026-3296

References

Frequently asked questions

What is CVE-2026-3296?: CVE-2026-3296 is a critical-severity vulnerability in Wpeverest Everest Forms – Contact Form, Payment Quiz, Survey & Custom Form Builder, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2026-04-08.
How severe is CVE-2026-3296?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2026-3296 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.