CVE-2025-8871

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8871", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-11T18:17:12.289Z", "datePublished": "2025-11-05T02:25:52.044Z", "dateUpdated": "2026-04-08T16:36:17.762Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:17.762Z"}, "affected": [{"vendor": "WPEverest", "product": "Everest Forms Pro", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.9.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mime_content_type() function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a non-required signature form field along with an image upload field. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only exploitable in PHP versions prior to 8."}], "title": "Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/11d45287-f875-4cc9-aaf6-47158fe32858?source=cve"}, {"url": "https://everestforms.net/changelog/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "cweId": "CWE-502", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 5.6, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Alex Thomas"}], "timeline": [{"time": "2025-08-19T19:51:45.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-04T14:21:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-05T18:56:13.108867Z", "id": "CVE-2025-8871", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T18:56:40.395Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8871", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-05T18:56:13.108867Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T18:56:18.636Z"}}], "cna": {"title": "Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature", "credits": [{"lang": "en", "type": "finder", "value": "Alex Thomas"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}}], "affected": [{"vendor": "WPEverest", "product": "Everest Forms Pro", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.9.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-19T19:51:45.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-04T14:21:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/11d45287-f875-4cc9-aaf6-47158fe32858?source=cve"}, {"url": "https://everestforms.net/changelog/"}], "descriptions": [{"lang": "en", "value": "The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mime_content_type() function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a non-required signature form field along with an image upload field. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only exploitable in PHP versions prior to 8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:17.762Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8871", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:36:17.762Z", "dateReserved": "2025-08-11T18:17:12.289Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-05T02:25:52.044Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Everest Forms Pro", "vendor": "WPEverest", "versions": [{"lessThanOrEqual": "1.9.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mime_content_type() function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a non-required signature form field along with an image upload field. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only exploitable in PHP versions prior to 8."}, {"lang": "es", "value": "El plugin Everest Forms (Pro) para WordPress es vulnerable a la inyecci\u00f3n de objetos PHP en todas las versiones hasta la 1.9.7, inclusive, a trav\u00e9s de la deserializaci\u00f3n de entrada no confiable en la funci\u00f3n mime_content_type(). Esto hace posible que atacantes no autenticados inyecten un objeto PHP. Esta vulnerabilidad puede ser explotada por atacantes no autenticados cuando un formulario est\u00e1 presente en el sitio con un campo de formulario de firma no requerido junto con un campo de carga de imagen. No hay una cadena POP conocida presente en el software vulnerable, lo que significa que esta vulnerabilidad no tiene impacto a menos que otro plugin o tema que contenga una cadena POP est\u00e9 instalado en el sitio. Si una cadena POP est\u00e1 presente a trav\u00e9s de un plugin o tema adicional instalado en el sistema objetivo, puede permitir al atacante realizar acciones como eliminar archivos arbitrarios, recuperar datos sensibles o ejecutar c\u00f3digo, dependiendo de la cadena POP presente. Esta vulnerabilidad solo es explotable en versiones anteriores a PHP 8."}], "id": "CVE-2025-8871", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8871", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-05T18:56:13.108867Z", "version": "2.0.3"}}]}, "published": "2025-11-05T03:15:42.880", "references": [{"source": "security@wordfence.com", "url": "https://everestforms.net/changelog/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/11d45287-f875-4cc9-aaf6-47158fe32858?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:58:38.320708+00:00", "value": {"mitigation_remediation": ["Update Everest Forms Pro to version 1.9.8 or later.", "Upgrade the site\u2019s PHP runtime to version 8.0 or newer, as the flaw is limited to older PHP versions.", "If an update is not immediately possible, remove or disable optional signature fields or image upload fields from forms to mitigate the injection risk or restrict form usage to trusted users."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated PHP Object Injection"}, "threat_synthesis": {"affected_systems": "The affected product is Everest Forms Pro, available from WPEverest, with all releases up to and including version 1.9.7 vulnerable. The flaw manifests only when the plugin is installed on a WordPress site containing a form that has an optional signature field and an image upload field.", "description_and_impact": "The vulnerability allows unauthenticated attackers to inject a PHP object through deserialization of untrusted data in the mime_content_type() function when a form contains an optional signature field and an image upload field. The injection alone does not provide a payload, but it can be leveraged if another plugin or theme supplies a PHP Object Persistence (POP) chain, enabling deletion of files, data disclosure, or code execution. The flaw is limited to PHP versions earlier than 8, so modern PHP installations are not affected.", "risk_and_exploitability": "The CVSS score is 5.6, indicating a moderate severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires unauthenticated access to the vulnerable form; no known exploit has been publicly documented. If a POP chain exists on the site, the attacker could achieve significant impact, but without such a chain the risk is comparatively low."}}}}, "created": "2025-11-05T10:47:00.853088+00:00", "updated": "2026-04-22T14:00:18.235768+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpeverest", "wpeverest$PRODUCT$everest_forms"]}