# Critical WordPress Plugin Flaw Under Active Exploitation—Update Everest Forms Pro Now
## The Threat
A critical remote code execution vulnerability in Everest Forms Pro, a popular WordPress plugin, is being actively exploited by threat actors to compromise websites and establish admin-level access. The flaw exists in the plugin's Calculation Addon, where user-submitted form data is directly concatenated into PHP code and executed without proper sanitization. This allows attackers to inject arbitrary PHP commands that run with full server privileges, effectively giving them complete control over affected websites.
Since April 13, 2026, security researchers have detected thousands of exploitation attempts targeting this vulnerability. The most common attack pattern involves creating a backdoor administrator account named "diksimarina" to maintain persistent access to compromised sites. With roughly 4,000 active installations, the plugin's moderate user base means real-world impact is already documented—this is not a theoretical risk.
The vulnerability specifically impacts the way the plugin handles the "Complex Calculation" feature. When a form includes calculations, any string-type field (text input, email, URL field, select dropdown, radio button) becomes an attack vector. Malicious actors need no authentication, no special privileges, and no interaction from site owners—they can submit a crafted form submission from anywhere on the internet and gain full code execution.
## Severity and Impact
| Field | Details |
|-------|---------|
| CVE ID | CVE-2026-3300 |
| CVSS Score | 9.8 (Critical) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Attack Complexity | Low |
| Attack Vector | Network |
| Authentication Required | None |
| User Interaction | None |
| Vulnerability Type | Remote Code Execution (RCE) via Unsafe eval() |
| CWE | CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code) |
| Exploitability | Active exploitation confirmed as of June 5, 2026 |
| Patched Version | 1.9.13 (released March 18, 2026) |
## Affected Products
- All installations running prior to version 1.9.13 are vulnerable
- Affects approximately 4,000 active WordPress sites
- Vulnerability specifically present in the Calculation Addon component
## Mitigations
Immediate Actions:
1. Update immediately — Upgrade Everest Forms Pro to version 1.9.13 or later. This is a critical security patch and should be treated as urgent.
2. Disable the Calculation Addon — If you cannot immediately update, deactivate the Calculation Addon through your WordPress plugin settings until patching is complete.
3. Check for unauthorized accounts — Log into WordPress admin and review the Users section for unexpected administrator accounts, particularly looking for accounts named "diksimarina" or other unfamiliar admin users. Delete any suspicious accounts and reset all remaining administrative passwords.
4. Audit for web shells and backdoors — Review your website's file system for suspicious PHP files that may have been uploaded. Common locations include /wp-content/uploads/, /wp-content/plugins/, and the root directory. Look for recently modified files and files with unusual names.
5. Monitor access logs — Check your web server and PHP error logs for evidence of exploitation attempts. Search for references to eval(), $_POST, or suspicious form field submissions. Pay particular attention to requests from the following IP addresses known to be used in attacks:
- 202.56.2.126
- 209.146.60.26
- 15.235.166.18
- 2402:1f00:8000:800::40db
- 185.78.165.153
6. Implement network segmentation — If you manage multiple WordPress sites, ensure they are isolated from one another to limit lateral movement in case of compromise.
7. Enable WordPress security hardening — Consider implementing security headers, rate limiting on form submissions, and Web Application Firewall (WAF) rules to detect and block malicious form submissions.
## References
---
## HackWire Analysis
The Everest Forms Pro exploitation represents a troubling intersection of common WordPress vulnerabilities and modern attacker efficiency. The use of eval() on user input is a security anti-pattern as old as PHP itself, yet developers continue shipping it in production code. What's notable here is the scale and coordination of the attack: 29,300+ exploitation attempts detected by a single security vendor suggests either automated scanning and compromise, or organized exploitation infrastructure. The consistent use of the same backdoor account name across attacks indicates either a single threat actor or a copycat campaign—either way, a sign that knowledge of the vulnerability has spread beyond security researchers into criminal toolkits.
The timing is also significant. Wordfence blocked the attacks starting in mid-April, nearly a month after the patch was released in March. This gap reveals a critical vulnerability in the WordPress update ecosystem: many site owners delay updates for fear of compatibility issues, leaving active installations exposed during this transition window. Some may have never updated at all. The recent surge in attack attempts (16 in the last 24 hours) suggests threat actors are still discovering unpatched installations and testing them systematically.
What defenders should recognize is the broader pattern this represents: form plugins are attractive attack surfaces because they're trusted, widely installed, and often forgotten during routine maintenance. If your WordPress site accepts form submissions—contact forms, registration, surveys, calculators—you have a plugin managing that input. Each of these is a potential RCE vector if the developer treats user input as executable code. This vulnerability should serve as a wake-up call to audit your entire plugin roster for similar patterns. The calculus has changed: updating slower is more dangerous than the small risk of a broken site after patching.
— HackWire Editorial
---
## Related Coverage