SecurityOnlineDdos
Everest Forms Pro flaw lets hackers take over WordPress sites
A critical vulnerability (CVE-2026-3300) in the Everest Forms Pro WordPress plugin allows unauthenticated attackers to execute arbitrary PHP code, potentially compromising entire websites. This flaw is linked to an input validation error within the plugin’s calculation feature, enabling attackers to inject malicious code via improperly handled single quotes.
An alarming surge in exploit attempts has been observed since April 2026, with automated attacks creating rogue admin accounts on targeted sites, such as ‘diksimarina’. Website administrators are urged to update to Everest Forms Pro version 1.9.13 or higher and audit user profiles for unauthorized accounts to mitigate this risk.
Story timeline CVE-2026-3300
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 4 Jun · 02:07 UTC | SecurityOnline | Everest Forms Pro flaw lets hackers take over WordPress sites (this article) |
| Thu 4 Jun · 16:40 UTC | Infosecurity | Critical RCE flaw in Everest Forms Pro lets hackers hijack sites |
| Mon 8 Jun · 12:20 UTC | SecurityWeek | CVE-2026-3300 flaw in Everest Forms Pro lets attackers run code |
| Mon 8 Jun · 14:40 UTC | Security Affairs | Everest Forms Pro WordPress Flaw is Handing Attackers Admin Access |