CVE-2026-62103: Wpeverest Everest Forms

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.

Affected products

• Wpeverest Everest Forms: up to and including 3.6.0

Published 2026-09-11. Last modified 2026-09-11.