Critical Remote Code Execution Vulnerability in Everest Forms Pro Triggers Widespread Exploitation

A high-severity security crisis is currently unfolding within the WordPress ecosystem as threat actors actively exploit a critical vulnerability in the Everest Forms Pro plugin. This flaw, which grants unauthenticated attackers the ability to achieve Remote Code Execution (RCE), has placed thousands of websites at risk of complete compromise. Security researchers warn that the vulnerability is being leveraged to inject malicious code, create rogue administrative accounts, and establish persistent backdoors on targeted servers.

The Core Vulnerability: CVE-2026-3300

The security flaw, officially tracked as CVE-2026-3300, has been assigned a CVSS score of 9.8, categorizing it as "Critical." The vulnerability exists within all versions of the Everest Forms Pro plugin up to and including 1.9.12. Everest Forms Pro, a widely used commercial form-building solution developed by WPEverest, currently powers approximately 4,000 active installations.

The discovery was made by a security researcher operating under the handle "h0xilo," who responsibly disclosed the finding through the Wordfence bug bounty program. Upon receiving the report, WPEverest acted to mitigate the risk by releasing version 1.9.13, which contains the necessary security patches. However, the window between disclosure and the emergence of active exploits has proven sufficient for attackers to launch a widespread campaign against unpatched sites.

Technical Breakdown: How the Exploit Works

The root cause of the vulnerability lies within the plugin’s "Calculation" add-on. This feature is designed to allow site administrators to perform complex mathematical operations based on user input. Under the hood, the plugin processes these formulas by passing them through PHP’s eval() function—a powerful but notoriously dangerous function that executes arbitrary code passed as a string.

The flaw occurs because the plugin’s input handling mechanism fails to properly sanitize submitted field values. Specifically, the sanitize_text_field() function, which is intended to scrub malicious characters from user input, fails to escape single quotes.

When a user submits data through a form—whether via text, email, URL, select, or radio fields—that input is concatenated into the PHP string intended for the eval() function. An attacker can exploit this by inputting a single quote, effectively "breaking out" of the intended data string. Once the attacker has closed the string, they can inject their own malicious PHP code, which the eval() function then executes with the same privileges as the WordPress web server.

It is important to note that this vulnerability is specifically restricted to forms where the "Complex Calculation" feature is enabled. For sites utilizing this specific configuration, the impact is total: an attacker can gain full control over the WordPress environment, allowing them to extract sensitive database information, upload webshells, or modify core system files.

Chronology of the Attack

The timeline of this campaign highlights the speed at which modern cyber-adversaries operationalize newly discovered vulnerabilities.

Everest Forms Pro Vulnerability Allows Remote Code Execution on WordPress Sites

Late March 2026: Initial public disclosure of the vulnerability occurs, prompting the release of the patched version 1.9.13 by WPEverest.
April 13, 2026: Security telemetry from Wordfence identifies the first wave of active exploitation attempts. This indicates that attackers likely reverse-engineered the patch or monitored the public disclosure closely to identify the entry point.
Late April – Early May 2026: The frequency of attacks steadily increases as automated bots begin scanning the internet for unpatched instances of Everest Forms Pro.
May 16, 2026: A massive surge in exploit activity is recorded. In this 24-hour period alone, Wordfence’s firewall blocked more than 17,900 individual attempts to compromise websites.
Present Day: Attacks remain ongoing. Threat actors are primarily focused on injecting code that creates a rogue administrator account under the username "diksimarina."

Supporting Data: The Scale of the Threat

The data provided by Wordfence serves as a sobering reminder of the automated nature of modern web attacks. Since the campaign began, the security firm has successfully blocked over 29,300 exploit attempts. This figure likely represents only a fraction of the total attack volume, as it only accounts for the traffic intercepted by Wordfence’s specialized firewall.

The sheer volume of attacks on May 16 suggests that the exploit code has been integrated into widespread "botnets"—networks of compromised machines that continuously scan the web for vulnerable plugins. The specific focus on creating the "diksimarina" administrator account indicates that the attackers are aiming for persistence; by creating a high-privileged user account, they ensure they can regain access to the site even if the plugin is eventually updated or if initial backdoors are removed.

Implications for Site Administrators

The implications of CVE-2026-3300 extend beyond the immediate risk of a hacked website. For businesses, a compromised WordPress site can lead to:

Data Breaches: If the form is used to collect customer data, that data is now potentially exposed to unauthorized parties.
SEO Poisoning: Attackers often use hijacked sites to host spam or redirect users to malicious domains, which can result in the site being blacklisted by search engines.
Malware Distribution: The site could be turned into a vector for distributing malware to the site’s own visitors, causing immense reputational damage.
Resource Exhaustion: Malicious scripts often utilize the host server’s CPU and memory, leading to site crashes and degraded performance for legitimate users.

Recommended Mitigation Steps

For administrators who are currently managing WordPress sites utilizing Everest Forms Pro, the following steps are non-negotiable:

Immediate Update: Ensure that the Everest Forms Pro plugin is updated to version 1.9.13 or higher. This is the only way to permanently close the vulnerability.
Audit User Accounts: Check the "Users" section of the WordPress dashboard for any unrecognized administrator accounts. Specifically, look for accounts named "diksimarina" or other suspicious usernames created within the last two months.
Review File Integrity: If you suspect your site was targeted during the period between April 13 and today, perform a thorough scan for unauthorized files, particularly in the /wp-content/uploads/ directory or any other writable folders.
Password Resets: If an unauthorized account was detected, assume that the database has been accessed. Perform a full reset of all administrative passwords and consider rotating security keys in the wp-config.php file.
Log Analysis: Examine server access logs for anomalous POST requests directed at forms that utilize the "Complex Calculation" feature.

The Recurring Problem of WordPress Security

The incident surrounding Everest Forms Pro is not an isolated event but rather a symptom of a larger, systemic issue in the WordPress ecosystem. With thousands of third-party plugins available, the attack surface for a typical WordPress site is often vast. While plugin developers generally work to secure their products, the reality is that the time between a patch’s release and its universal adoption by site administrators is often long enough for attackers to strike.

Security professionals argue that the burden of security cannot rest solely on the plugin developer. Site owners must adopt a "defense-in-depth" strategy, which includes:

The Principle of Least Privilege: Do not grant administrative access to users unless absolutely necessary.
Regular Backups: Maintain off-site, offline backups that can be used to restore the site in the event of a total compromise.
Security Monitoring: Utilize Web Application Firewalls (WAFs) and real-time monitoring tools that can identify and block malicious patterns before they reach the application layer.
Plugin Pruning: Regularly audit installed plugins and remove those that are no longer in use or are no longer receiving updates from their developers.

Conclusion

CVE-2026-3300 serves as a potent reminder that even niche, commercial plugins can become high-value targets for cybercriminals. As long as vulnerabilities like improper input sanitization remain in active codebases, attackers will continue to refine their methods to exploit them.

The threat posed by this vulnerability is significant, but it is manageable for administrators who act with urgency. The path forward for the WordPress community is clear: prioritizing the rapid deployment of security updates and maintaining a vigilant posture regarding site integrity are the only ways to defend against the ever-evolving landscape of automated web threats. As the digital landscape grows more complex, the cost of complacency is rising, making robust security hygiene more important than ever.