CVE-2026-3300

Everest Forms Pro, a premium WordPress form-builder plugin, contains an unauthenticated PHP code-injection flaw (CWE-94) in its Calculation Addon, where the process_filter() function concatenates user-submitted form field values into a PHP code string that is passed to eval() without adequate escaping. The sanitize_text_field() sanitization applied to input does not escape single quotes or other PHP-context characters, so an unauthenticated attacker can submit a crafted value in any string-type form field (text, email, URL, select, radio) on a form using the 'Complex Calculation' feature and execute arbitrary PHP code on the server. Successful exploitation yields full remote code execution (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N), and related reporting indicates attackers are using it to take over sites and gain admin access, with the WP-SHELLSTORM campaign described as having backdoored thousands of WordPress sites. Any WordPress site running Everest Forms Pro in version 1.9.12 or earlier, where a form uses the Calculation Addon's Complex Calculation feature, is affected. No public proof-of-concept is known and the flaw is not in CISA KEV, but multiple news outlets report active in-the-wild exploitation, and the 39.2% EPSS score (99th percentile) indicates a high probability of exploitation within 30 days.

What to do: Update Everest Forms Pro to a version newer than 1.9.12 as soon as possible; as an interim mitigation, disable or remove forms that use the Calculation Addon's Complex Calculation feature (or deactivate the addon). Because the flaw is being actively exploited to backdoor sites and obtain admin access, check affected sites for unauthorized administrator accounts, suspicious or newly modified files and webshells, and unknown plugins/themes, and review form-submission logs for anomalous values in string-type fields.