WordPress Everest Forms PHP Object Injection Vulnerability

A deserialization vulnerability allowing PHP object injection has been identified in the WordPress Everest Forms plugin, affecting versions through 3.2.2. This vulnerability could lead to various types of code injection, including SQL injection, path traversal, and denial-of-service, especially if a suitable object injection chain is exploited.

Impact

Exploitation of this vulnerability could allow for PHP object injection, with potential consequences including arbitrary code execution, SQL injection, path traversal, and denial-of-service, if an appropriate object injection chain is utilized.

Remediation

Users of the WordPress Everest Forms plugin should update to version 3.2.3 or later. Patchstack users can enable auto-updates for vulnerable plugins.