CVE-2026-62103

Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.

Published Sep 11, 2026
CVSS 9.8 critical
0.6% chance of exploitation in the next 30 days (EPSS)

Affected software

wpeverest Everest Forms

CVE-2026-62103 at the National Vulnerability Database