2 lines
4.1 KiB
JSON
2 lines
4.1 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder","vendor":"wpeverest","versions":[{"lessThanOrEqual":"3.4.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize() on stored entry meta values without passing the allowed_classes parameter. This makes it possible for unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload survives sanitize_text_field() sanitization (serialization control characters are not stripped) and is stored in the wp_evf_entrymeta database table. When an administrator views entries or views an individual entry, the unsafe unserialize() call processes the stored data without class restrictions."},{"lang":"es","value":"El plugin Everest Forms para WordPress es vulnerable a la inyección de objetos PHP en todas las versiones hasta la 3.4.3, inclusive, a través de la deserialización de entrada no confiable de los metadatos de entrada de formulario. Esto se debe a que el archivo html-admin-page-entries-view.php llama a la función nativa unserialize() de PHP en los valores meta de entrada almacenados sin pasar el parámetro allowed_classes. Esto hace posible que atacantes no autenticados inyecten una carga útil de objeto PHP serializado a través de cualquier campo de formulario público de Everest Forms. La carga útil sobrevive a la sanitización de sanitize_text_field() (los caracteres de control de serialización no se eliminan) y se almacena en la tabla de la base de datos wp_evf_entrymeta. Cuando un administrador ve las entradas o ve una entrada individual, la llamada insegura a unserialize() procesa los datos almacenados sin restricciones de clase."}],"id":"CVE-2026-3296","lastModified":"2026-07-25T10:10:00.167","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3296","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-08T14:21:41.571035Z","version":"2.0.3"}}]},"published":"2026-04-08T02:16:04.067","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/admin/views/html-admin-page-entries-view.php#L133"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/evf-core-functions.php#L5594"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/admin/views/html-admin-page-entries-view.php#L133"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3489938/everest-forms/tags/3.4.4/readme.txt?old=3464753&old_path=everest-forms%2Ftags%2F3.4.3%2Freadme.txt"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?old_path=/everest-forms/tags/3.4.3&new_path=/everest-forms/tags/3.4.4"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2693ae37-790d-4b18-a9ec-054c8c27b8bc?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@wordfence.com","type":"Secondary"}]}
|