Everest Forms Pro Vulnerability Allows Remote Code Execution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-3300 | Unauthenticated RCE via PHP Code Injection in Everest Forms Pro WordPress Plugin Everest Forms Pro, a premium WordPress form-builder plugin, contains an unauthenticated PHP code-injection flaw (CWE-94) in its Calculation Addon, where the process_filter() function concatenates user-submitted form field values into a PHP code string that is passed to eval() without adequate escaping. The sanitize_text_field() sanitization applied to input does not escape single quotes or other PHP-context characters, so an unauthenticated attacker can submit a crafted value in any string-type form field (text, email, URL, select, radio) on a form using the 'Complex Calculation' feature and execute arbitrary PHP code on the server. Successful exploitation yields full remote code execution (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N), and related reporting indicates attackers are using it to take over sites and gain admin access, with the WP-SHELLSTORM campaign described as having backdoored thousands of WordPress sites. Any WordPress site running Everest Forms Pro in version 1.9.12 or earlier, where a form uses the Calculation Addon's Complex Calculation feature, is affected. No public proof-of-concept is known and the flaw is not in CISA KEV, but multiple news outlets report active in-the-wild exploitation, and the 39.2% EPSS score (99th percentile) indicates a high probability of exploitation within 30 days. Do: Update Everest Forms Pro to a version newer than 1.9.12 as soon as possible; as an interim mitigation, disable or remove forms that use the Calculation Addon's Complex Calculation feature (or deactivate the addon). Because the flaw is being actively exploited to backdoor sites and obtain admin access, check affected sites for unauthorized administrator accounts, suspicious or newly modified files and webshells, and unknown plugins/themes, and review form-submission logs for anomalous values in string-type fields. | 9.8 | 39% |
| moderatelikely in the thousands to low tens of thousands of WordPress sites at most (premium-only plugin, and only sites whose forms use the Calculation Addon's… |
Full article363 words · extracted from infosecurity-magazine.com · click to collapse
A critical vulnerability in the Everest Forms Pro plugin for WordPress has been actively exploited to hijack vulnerable websites.
According to new analysis from WordPress security firm Wordfence, the remote code execution flaw lets unauthenticated attackers run PHP on a target server and take over the site.
Tracked as CVE-2026-3300, the bug scores 9.8 on the CVSS scale and affects every release up to and including 1.9.12. Everest Forms Pro is a commercial form builder from developer WPEverest, with roughly 4000 active installations.
The flaw was reported to Wordfence's bug bounty program by a researcher using the handle h0xilo.
WPEverest patched the flaw in version 1.9.13. Any site on an earlier build remains exposed, and administrators have been urged to update without delay.
Read more on WordPress plugin attacks: Major WordPress Plugin Flaw Exploited in Under 4 Hours
Single Quotes Slip Past Sanitization
At the core of the bug is the WordPress plugin's Calculation add-on, which runs a form's calculation formula through PHP's eval() function.
Submitted field values are concatenated into that PHP string before it runs, and sanitize_text_field() does not escape single quotes. An attacker can open a value with a quote, break out of the wrapping string and inject PHP that eval() then executes.
Only forms that switch on the "Complex Calculation" feature are exposed to the PHP code injection. On those, any text, email, URL, select or radio field can serve as the entry point.
From there, a successful attack can create rogue administrator accounts, plant webshells and open further footholds.
Rogue Admin Accounts and Blocked Attacks
Wordfence telemetry shows the attacks began on April 13, 2026, about two weeks after public disclosure. Its leading payload tried to register an administrator account named "diksimarina."
In total, the firm said its firewall has blocked more than 29,300 exploit attempts. A surge on May 16 accounted for over 17,900 of them in a single day.
Defenders reviewing their logs should watch for the following indicators:
-
Administrator account using the name "diksimarina"
-
The email address [email protected]
-
Requests from 202.56.2.126, the source of more than 26,300 blocked attempts
Flaws that hand attackers administrator access have become a recurring problem for WordPress operators.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/everest-forms-pro-rce-actively/