CVE-2026-3296 is a critical PHP Object Injection vulnerability in the Everest Forms WordPress plugin (up to version 3.4.3). The vulnerability arises because the plugin calls PHP's native unserialize() function on stored form entry metadata without restricting allowed classes, enabling deserialization of untrusted input. Attackers can inject serialized object payloads through public form fields that bypass sanitize_text_field() sanitization and are stored in the wp_evf_entrymeta database table. When an administrator views form entries, the unsafe unserialize() call processes this data, potentially allowing remote code execution or other severe impacts.

This vulnerability allows unauthenticated attackers to perform PHP Object Injection, potentially leading to remote code execution, full site compromise, and complete loss of confidentiality, integrity, and availability of the affected WordPress site. The CVSS 3.1 base score is 9.8 (critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, it is recommended to restrict administrative access to the WordPress backend to trusted users only and consider disabling or removing the Everest Forms plugin if possible. Monitor vendor communications for updates and apply official patches immediately once released.