# Critical Everest Forms Pro Vulnerability Actively Exploited to Hijack WordPress Sites


A critical unauthenticated code execution vulnerability in the popular Everest Forms Pro WordPress plugin is being actively exploited in the wild to create rogue administrator accounts and seize control of websites. The flaw, tracked as CVE-2026-3300, affects all versions of the plugin through 1.9.12 and requires no special authentication or elevated privileges to trigger—making it an immediately exploitable vector for attackers.


Security researchers and hosting providers are reporting a surge in exploitation attempts, with Wordfence firewall telemetry showing over 29,300 blocked attack attempts since active exploitation began on April 13, 2026.


## The Threat


The vulnerability stems from a dangerous coding pattern in Everest Forms Pro's Complex Calculation feature, which dynamically generates and executes PHP code without proper input validation. Attackers are submitting specially crafted form values that break out of the intended string context, inject arbitrary PHP code, and gain immediate shell-level access to the underlying web server.


Once inside, attackers create hidden administrator accounts that persist even after patches are applied—giving them durable backdoor access to:


  • Modify website content and inject malicious redirects
  • Install malicious plugins and themes to maintain persistence
  • Plant webshells for direct server access
  • Export or manipulate databases containing customer and business data
  • Redirect payment processing and e-commerce transactions

    • Unlike many WordPress vulnerabilities, this flaw requires zero user interaction beyond deploying the vulnerable code—if a site is running the affected version, it is exposed.


    ## Background and Context


    Everest Forms is a widely-installed open-source form builder for WordPress, with a commercial Pro add-on that extends functionality for advanced use cases. Organizations across industries rely on Everest Forms Pro to:


  • Build contact and inquiry forms
  • Process registration and enrollment workflows
  • Collect payment information
  • Create custom application forms for leads and customer data

    • The plugin boasts thousands of active installations across business websites, agencies, educational institutions, and e-commerce platforms. Many site owners treat form plugins as "safe" because they appear low-risk—but in reality, form builders are high-value targets, as they:


    1. Accept and process untrusted user input

    2. Often run with elevated database permissions

    3. Sit in direct communication paths with web forms and backend systems

    4. Are frequently deprioritized in security patching cycles


    The CVE-2026-3300 vulnerability was reported to the plugin developers in February 2026 through the Wordfence security team. The developers acknowledged the issue and released a patch on March 18, 2026. However, adoption of security patches in the WordPress ecosystem is notoriously slow—many site owners fail to update promptly, if at all.


    ## Technical Details


    ### The Root Cause: PHP eval() Anti-Pattern


    The vulnerability exists in how the Complex Calculation feature processes user input:


    1. Form submission: User submits a value into a text field

    2. String concatenation: The plugin constructs a PHP code string, inserting the user value directly into the middle

    3. Code execution: The resulting string is executed using PHP's eval() function


    Example (simplified vulnerable pattern):

    $user_input = $_POST['field_value'];
$sanitized = sanitize_text_field($user_input);
$code = "return " . $sanitized . ";";
eval($code);

    While the plugin calls sanitize_text_field(), this WordPress function only removes HTML tags and excessive whitespace—it does not escape single quotes or other characters that control PHP syntax.


    ### Breaking Out of the String Context


    An attacker submits:

    ' . wp_insert_user(['user_login' => 'diksimarina', 'role' => 'administrator', 'user_pass' => 'password123']) . '

    When inserted into the generated PHP code, this becomes:

    return '' . wp_insert_user(['user_login' => 'diksimarina', ...]) . '';

    The injected wp_insert_user() function executes during the calculation, creating a new administrator account instantly.


    ### Covering the Tracks


    The attacker may add a // comment marker at the end of their payload to comment out any remaining generated code, ensuring no syntax errors that might alert administrators or generate error logs.


    ### Exploitation Data


    | Metric | Value |

    |--------|-------|

    | Vulnerability ID | CVE-2026-3300 |

    | Affected Versions | Everest Forms Pro 1.9.12 and earlier |

    | CVSS Score | 9.8 (Critical) |

    | Authentication Required | No |

    | Patch Released | March 18, 2026 |

    | Exploitation Start Date | April 13, 2026 |

    | Blocked Attempts (by Wordfence) | 29,300+ |

    | Primary Attacker IPs | 202.56.2[.]126, 209.146.60.26 (and others) |


    ## Implications


    ### Immediate Risk to WordPress Sites


    Any website running Everest Forms Pro version 1.9.12 or earlier is currently vulnerable to unauthenticated remote code execution. The attack requires only:


  • A working form page on the target site
  • The ability to submit form data (which any visitor can do)
  • No authentication, session, or prior access

    • ### Scope of Impact


    Organizations affected span multiple sectors:


  • E-commerce sites accepting payment forms
  • SaaS platforms with signup and registration workflows
  • Educational institutions collecting student/applicant data
  • B2B service providers capturing leads and inquiries
  • Healthcare organizations collecting patient intake forms
  • Government and nonprofits processing benefit applications

    • ### Post-Compromise Persistence


    Attackers who successfully create admin accounts can:


  • Persist indefinitely even after the vulnerability is patched
  • Access exported customer databases and payment information
  • Install backdoor plugins that survive plugin updates
  • Use compromised sites as staging servers for lateral movement into networks, especially if the WordPress server has internal network access
  • Inject SEO poisoning and malware redirection to damage site reputation

    • ## Recommendations


    ### Immediate Actions (Next 24 Hours)


    1. Update immediately: If you run Everest Forms Pro, update to version 1.9.13 or later *without delay*

    2. Check administrator accounts: Review your WordPress user list for any unfamiliar accounts, especially "diksimarina" or other suspicious usernames

    3. Review access logs: Check web server and WordPress access logs for POST requests to form endpoints originating from the IP addresses listed above

    4. Change all admin passwords: Force password resets for all WordPress administrator accounts


    ### Short-Term Hardening (This Week)


  • Audit database exports: Check WordPress database for suspicious users inserted between April 13 and now
  • Review user capabilities: Use a security plugin to audit what permissions each admin account actually possesses
  • Check for backdoor plugins: Look for recently-installed plugins that don't match your approved list
  • Monitor file integrity: Use WordPress file integrity monitoring to detect any unauthorized plugin or theme modifications
  • Review form submissions: Audit stored form data for signs of injection attempts (single quotes, PHP code snippets, etc.)

    • ### Long-Term Preventive Measures


  • Establish a patching schedule: Create a routine to check for WordPress and plugin updates at least weekly
  • Use security plugins: Deploy Wordfence, iThemes Security, or Sucuri to provide firewall rules and malware scanning
  • Limit form functionality: If you don't use the Complex Calculation feature, disable it in plugin settings
  • Apply Web Application Firewall rules: Many WAF providers have released rules to block CVE-2026-3300 exploitation attempts
  • Regular security audits: Schedule quarterly reviews of installed plugins and their security posture
  • Consider a managed WordPress host: Use providers that automatically patch plugins and provide managed security monitoring

    • ### For Hosting Providers and Agencies


  • Proactive patching: Push updates to all client sites running vulnerable versions
  • Mandatory security notifications: Alert all customers with Everest Forms Pro installations
  • IP blocking: Implement firewall rules to block attack source IPs at the edge
  • Intrusion detection: Tune IDS/IPS systems to flag POST requests with PHP injection patterns

    • ---


    ## HackWire Analysis


    CVE-2026-3300 represents a broader crisis in the WordPress plugin ecosystem: the prevalence of dangerous coding anti-patterns at scale. The use of eval() with unsanitized user input is a textbook code execution vulnerability—one that security training has discouraged for 20+ years—yet it persists in actively maintained, commercially distributed software.


    What makes this exploitation particularly dangerous is the 32-day gap between patch release and active attack. For most of that window, site owners had no urgency signal. By the time exploitation became visible in telemetry (April 13), tens of thousands of unpatched sites had already been compromised. The attackers are now likely sitting in dormant admin accounts, waiting to move laterally into networks or extract data at scale.


    The pattern is familiar: a critical plugin vulnerability, slow patch adoption, active exploitation, data breach discovery weeks or months later. But here's the angle other reporting is missing: WordPress sites are no longer just web properties—they're gateways into corporate networks. A compromised WordPress form server with network visibility can become the beachhead for domain-wide compromise. Security teams that treat "WordPress updates" as a low-priority operational task rather than a critical security control are assuming unacceptable risk.


    For defenders, the lesson is unambiguous: form-building plugins should be treated with the same rigor as authentication systems. They touch user input, execute code, and integrate with databases. A 32-day patching lag is unacceptable. Organizations should adopt automated patching for security updates and, where that's not feasible, implement compensating WAF rules immediately.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)