9.8Kritisch

CVE-2026-62103WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability

wpeverest Everest Forms Veröffentlicht: 2026-09-11 21:12 (vor 2 Monaten)

Beschreibung

Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.

Schwachstellentyp (CWE): CWE-502

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
wpeverest	Everest Forms	≤ 3.6.0

Referenzen und Patches

https://patchstack.com/database/wordpress/plugin/everest-forms/vulnerability/wordpress-everest-forms-plugin-3… vdb-entry

CVSS-Score

9.8Kritisch

Quelle: Patchstack · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Alle Scores (2)

cna	CVSS 3.1	9.8Kritisch
audit@patchstack.com	CVSS 3.1	9.8Kritisch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.56%

höher als 47 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: yes
Technische Auswirkung: total

Zeitverlauf

ID reserviert2026-07-13
Veröffentlicht2026-09-11 21:12
Bei IP-DB eingegangen2026-10-24 23:45
Zuletzt aktualisiert2026-09-12 00:17

Vergeben von (CNA): Patchstack
NVD-Status: Deferred

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

8.8Hoch

CVE-2026-125836 vor 39 Minuten

WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability

Nicu Micle Simple JWT Login

Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8.

Ohne Score

CVE-2026-124817 vor 2 Stunden

Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

Clockinator Lite

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.

Ohne Score

CVE-2026-76792 vor 2 Stunden

User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification

User Verification by PickPlugins

The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, …

Ohne Score

CVE-2026-124652 vor 2 Stunden

Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR

Mine CloudVod

The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before returning its payment status, allowing any authenticated user, such as subscriber, to read other customers' order status, the purchased item an…

Ohne Score

CVE-2026-124653 vor 2 Stunden

Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure

Mine CloudVod

The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site'…

Ohne Score

CVE-2026-124665 vor 2 Stunden

Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR

Order Tracking

The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the …