CVE-2025-3439

CVE-2025-3439 is a critical PHP Object Injection vulnerability affecting all versions up to and including 3.1.1 of the Everest Forms plugin for WordPress. This flaw, stemming from untrusted deserialization of the 'field_value' parameter, allows unauthenticated attackers to inject PHP Objects. Rated 9.8 Critical on CVSS, this vulnerability has a network attack vector and low attack complexity, potentially leading to high impact on confidentiality, integrity, and availability if a suitable Property-Oriented Programming (POP) chain exists on the system. While the Everest Forms plugin itself lacks a POP chain, its presence in other installed plugins or themes could enable arbitrary file deletion, sensitive data retrieval, or code execution. Currently, there is no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB. The vulnerability has also received minimal community discussion and media coverage, indicating a low level of public awareness at this time.