CVE-2026-3300: Critical RCE vulnerability in Everest Forms Pro actively exploited in mass attacks

WordPress site owners are facing a serious security threat as attackers actively exploit a critical remote code execution (RCE) vulnerability in the Everest Forms Pro plugin. Tracked as CVE-2026-3300, the flaw carries a CVSS score of 9.8, placing it in the critical severity category. The vulnerability affects all Everest Forms Pro versions up to and including 1.9.12 and can be exploited without authentication.

Security monitoring has already recorded large-scale exploitation attempts targeting vulnerable websites, making immediate remediation a priority for affected organizations.

Vulnerability detailsLink to heading

The vulnerability was publicly disclosed on March 30, 2026, while the vendor released a security fix on March 18, 2026.

Despite the availability of a patch, attackers began targeting unpatched installations on April 13, 2026. Security telemetry has since blocked more than 29,300 exploitation attempts, including a major spike on May 16, when more than 17,900 attacks were detected within a single day.

The rapid increase in attack volume suggests that threat actors quickly integrated the vulnerability into automated scanning and exploitation campaigns.

>>> Learn more: CVE-2026-3844: Critical security vulnerability in Breeze Cache threatens over 400,000 WordPress websites

Root cause of CVE-2026-3300Link to heading

The flaw originates from the plugin's Complex Calculation feature. Researchers found that the vulnerable code resides in the process_filter() function. This function dynamically generates PHP code by combining user-supplied form input with server-side logic. The resulting code is then executed through PHP's eval() function.

Using eval() on data influenced by user input is widely considered dangerous because it can allow attackers to inject and execute arbitrary code.

Although the plugin applies WordPress's sanitize_text_field() function to incoming data, this protection is insufficient in this case. The sanitization process does not escape certain characters, including single quotation marks, which allows attackers to break out of the intended string context and inject malicious PHP commands.

As a result, a remote attacker can deliver a specially crafted payload through standard form fields and gain control over code execution on the server.

Affected input fields include:

• Text fields
• Email fields
• URL fields
• Select fields
• Radio button inputs

No login credentials or elevated permissions are required to trigger the vulnerability.

How the attack worksLink to heading

Attackers exploit the flaw by injecting a single quotation mark followed by arbitrary PHP code and a comment sequence. When the vulnerable function processes the malicious input, the injected code becomes part of the dynamically generated PHP statement executed by eval().

This leads directly to remote code execution, allowing attackers to run commands on the affected server. Observed attack campaigns show a common objective: creating unauthorized administrator accounts.

One frequently observed payload abuses WordPress's wp_insert_user() function to create a new administrator account with the username "diksimarina".

Once administrative access is established, attackers can:

• Upload web shells
• Install backdoors
• Modify website content
• Deploy malware
• Access sensitive data
• Move deeper into the hosting environment

At that stage, the compromise often extends beyond the WordPress application itself.

Indicators of compromiseLink to heading

Security researchers have identified several IP addresses actively involved in exploitation activity.

Known malicious sources include:

• 202.56.2.126
• 209.146.60.26
• 15.235.166.18
• 2402:1f00:8000:800::40db
• 185.78.165.153

These addresses have generated thousands of malicious requests and should be considered high-priority indicators for monitoring and blocking.

Most attacks target the WordPress AJAX endpoint:

/wp-admin/admin-ajax.php

Attackers submit specially crafted POST requests designed to trigger the vulnerable calculation logic.

Who is at risk?Link to heading

Any website running Everest Forms Pro version 1.9.12 or earlier is vulnerable. The risk becomes significantly higher when the Complex Calculation feature is enabled and exposed through public forms. Because exploitation requires no authentication and can be launched remotely, internet-facing WordPress sites are particularly attractive targets.

Organizations that rely on online registration forms, contact forms, surveys, or custom data collection workflows should review their deployments immediately.

Recommended actionsLink to heading

Site administrators should update Everest Forms Pro to the latest patched version without delay.

In addition, administrators should:

1. Review all WordPress administrator accounts.
2. Remove any unknown or unauthorized users.
3. Inspect server and application logs for suspicious POST requests.
4. Search for activity originating from known malicious IP addresses.
5. Check for newly uploaded files, web shells, or unexpected plugin modifications.
6. Verify that no unauthorized scheduled tasks or backdoors remain on the system.

Even if a site has already been patched, a review for signs of prior compromise remains important because attackers may have gained access before the update was applied.

Critical vulnerabilities such as CVE-2026-3300 demonstrate how a WordPress website can become the target of automated attacks within hours of technical details being disclosed. In addition to updating plugins and checking for signs of compromise, website owners should implement additional security layers to reduce risk. 

W7SFW (WordPress Firewall) helps monitor incoming traffic, detect suspicious requests, and block various attack attempts targeting WordPress websites. If your site relies on online forms or multiple third-party plugins, enable W7SFW today to strengthen your defenses against ongoing threats across the internet.

ConclusionLink to heading

CVE-2026-3300 represents one of the most serious WordPress vulnerabilities disclosed this year. Its combination of unauthenticated access, remote code execution, and active exploitation makes it a high-risk threat for any organization running affected versions of Everest Forms Pro.

With thousands of attacks already observed in the wild, administrators should assume that automated scanning is ongoing and act immediately. Timely patching, log analysis, and continuous monitoring remain the most effective measures for reducing exposure and preventing a full compromise.