Any organization running a WordPress website with Everest Forms installed is at risk of full server compromise through their own public contact forms — no attacker login is required. A successful exploit can give attackers persistent access to the web server, enabling data theft, ransomware deployment, or use of the server in further attacks, any of which can trigger breach notification obligations under GDPR, state privacy laws, or sector-specific regulations. The reputational damage from a compromised public-facing website and the operational cost of incident response and recovery typically far exceed the effort of applying the available patch.
You Are Affected If
You run the wpeverest Everest Forms WordPress plugin version 3.4.3 or earlier in production
Your WordPress site has at least one public-facing form powered by Everest Forms (contact forms, registration forms, surveys, etc.)
Your WordPress admin users view form entries through the Everest Forms entries dashboard
Your environment has not been updated to Everest Forms 3.4.4 or later
Your WAF or IPS does not block serialized PHP object payloads (O: patterns) in HTTP POST request bodies
Board Talking Points
A critical, actively exploited flaw in a widely used WordPress form plugin allows attackers to fully compromise our web servers through our own public contact forms — no credentials required.
IT should patch or disable the affected plugin within 24 hours; a patch is available and the fix is straightforward.
If left unpatched, attackers can install persistent backdoors, steal data, or deploy ransomware — triggering breach notification obligations and significant recovery costs.
GDPR — WordPress sites collecting personal data via Everest Forms (names, emails, contact details) may face breach notification obligations if the vulnerability was exploited before patching
CCPA / US State Privacy Laws — same exposure applies if the affected site collects personal information from consumers in applicable jurisdictions
