CVE-2026-62103

CVE-2026-62103 is an unauthenticated PHP object injection vulnerability in the Everest Forms WordPress plugin, caused by deserialization of untrusted data (CWE-502). An attacker who can reach the affected code path without logging in can supply crafted serialized values, causing the plugin to instantiate arbitrary PHP objects. Depending on the object classes (gadget chains) present in a site's installed plugins, this can escalate to arbitrary file deletion, data modification, and potentially remote code execution, consistent with the assigned critical 9.8 CVSS score. All WordPress sites running Everest Forms version 3.6.0 or earlier are affected. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and there is no confirmed exploitation in the wild at this time.

What to do: Update Everest Forms to the latest available release (any version above 3.6.0) on all WordPress sites, prioritizing internet-facing sites given the unauthenticated, network-exploitable nature of the flaw. If patching must be delayed, deactivate the plugin as a stopgap and review web server and WordPress logs for suspicious unauthenticated requests or signs of object-injection abuse.