Loading vulnerability…
CVE-2026-3296 is a PHP object injection vulnerability in the Everest Forms plugin for WordPress affecting all versions up to and including 3.4.3. The flaw is caused by unsafe deserialization of untrusted form entry metadata in the administrative entry-viewing workflow. Specifically, the plugin stores attacker-controlled form field content in entry metadata and later, in html-admin-page-entries-view.php, invokes PHP's native unserialize() on stored values without restricting allowed classes. Because serialized payload syntax survives the plugin's use of sanitize_text_field(), an unauthenticated attacker can submit a crafted serialized object through any public Everest Forms form field and have it persisted in the database. When an administrator later views the entries list or an individual entry, the stored payload is deserialized, allowing arbitrary object instantiation and potential POP-chain execution within the WordPress runtime.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone exploit project with two files: a Python exploit/scanner (CVE-2026-3296.py) and a detailed README describing the vulnerability and usage. It targets CVE-2026-3296 in the Everest Forms WordPress plugin (versions <= 3.4.3), an unauthenticated PHP object injection issue that becomes code execution when an administrator views a malicious form entry. The Python script is operational rather than a mere detector. Its structure includes: terminal/progress helpers; a payload library builder; form discovery logic that crawls common site paths and /sitemap.xml; parsing routines to extract Everest Forms form IDs, nonce values, and field names; injection logic to submit serialized PHP object strings into public forms; optional admin-authenticated trigger logic to log into WordPress and open the vulnerable entry view; scan/full/trigger/inject modes; and multithreaded bulk-target processing with JSON output. The script supports single-target and list-based operation. Exploit capability is two-phase. Phase 1 is unauthenticated web injection: the script finds a public Everest Forms page, reads the embedded nonce and form metadata, and submits a crafted serialized object in a form field so it is stored in entry metadata. Phase 2 is trigger/execution: when the stored entry is viewed in the Everest Forms admin interface (/wp-admin/admin.php?page=evf-entries&view-entry=...), the plugin unserializes attacker-controlled data without allowed_classes restrictions, enabling POP gadget execution if suitable classes are present. The script can automate this trigger if admin credentials are supplied. Built-in payloads include a benign stdClass probe for vulnerability confirmation, a test file-write payload targeting /tmp/pwned.txt, an OOB callback payload using a supplied callback URL (default template uses http://example.com), and placeholder strings for PHPGGC-generated WordPress, Yoast, and Monolog RCE gadget chains. Because the real RCE chains are placeholders rather than fully embedded weaponized chains, the repository is best classified as OPERATIONAL rather than fully weaponized. No evidence suggests this is fake. It is not just a README and not solely a detection script; it contains working exploit automation for discovery, injection, optional admin login, and trigger orchestration.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated PHP Object Injection vulnerability affecting Everest Forms WordPress Plugin versions 3.4.3 and earlier.
A PHP Object Injection vulnerability in the Everest Forms plugin for WordPress affecting all versions up to and including 3.4.3, caused by unsafe unserialize() use on untrusted stored entry metadata without allowed_classes restrictions. Unauthenticated attackers can inject serialized PHP object payloads through public forms, which are later processed when an administrator views entries.
A critical unauthenticated PHP object injection/deserialization vulnerability in the Everest Forms WordPress plugin that allows attackers to submit serialized payloads via public forms and trigger arbitrary object instantiation when an administrator views form entries.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.