CVE-2026-62103: Unauthenticated PHP Object Injection in WordPress Plugin Everest Forms, CVSS 9.8
Everest Forms 3.6.0 and earlier have unauthenticated PHP object injection CVE-2026-62103, CVSS 9.8. No login required to submit malicious serialized data; a POP chain already on the site can yield code execution.
On 11 Sep 2026, Patchstack disclosed unauthenticated PHP object injection CVE-2026-62103 in the WordPress form-builder plugin Everest Forms. CVSS 3.1 score 9.8. Affects 3.6.0 and earlier. Fixed in 3.6.1. An attacker needs no account: submit crafted serialized data over the network, trigger untrusted deserialization; if another component on the site supplies a usable POP chain, this upgrades to RCE.
Incident overview
Everest Forms is a drag-and-drop form builder for leads, registrations, and contact forms, with a large install base. This vuln is CWE-502 Deserialization of Untrusted Data, submitted by researcher LueRader via the Patchstack bug bounty. Affected range is explicit: plugin version ≤ 3.6.0.
Technical details
Root cause: the plugin uses native PHP object deserialization on user-controllable data without sufficient restriction on the deserialized content. Attack vector: network, low complexity, no privileges, no user interaction. Entry point is the plugin's publicly exposed form-handling interface. Attackers send a crafted serialized string directly.
Severity of PHP object injection depends on whether a usable POP chain exists in the site environment—a chain of magic methods that can be stitched together. If a chain is found, the attacker can escalate to arbitrary code execution, SQLi, arbitrary file delete, or DoS. Final impact of a single plugin vuln is determined by the whole-site dependency mix. That is why this class of bug more often causes real damage on enterprise and commercial sites.
Impact
CVSS 3.1 vector: `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. Typical WordPress plugin exploit cadence: mass scans within hours of disclosure. Attackers walk sites looking for plugin path and version fingerprints. No login required; any reachable form endpoint is enough. Attack surface is far larger than authenticated plugin bugs. Sites that collect customer data via forms also face data tampering or theft, beyond code execution.
Remediation
- Upgrade the plugin to 3.6.1 or later via admin or CLI:
wp plugin update everest-forms
wp plugin get everest-forms --field=version- If upgrade is not possible immediately, deactivate (`wp plugin deactivate everest-forms`). If forms must stay up, use a WAF to block request bodies containing serialized-object signatures such as `O:`, `C:`, or restrict origin on the form submit endpoint;
- Hunt historical logs: POST bodies to `/wp-admin/admin-ajax.php` with serialization signatures, and unexpected file changes under the plugin directory;
- After upgrade or deactivation, still run a full-site check: unknown admin accounts, abnormal cron, suspicious PHP files. Confirm no foothold webshell was planted.
References
- CVE Record: CVE-2026-62103
- Patchstack: Everest Forms 3.6.0 PHP Object Injection
- IONIX Threat Center: CVE-2026-62103
- Enigma Global: Daily Threat Intelligence Digest 2026-09-12