ATTACKERS are actively exploiting a remote code execution flaw in the Everest Forms Pro WordPress plugin, hijacking admin privileges on thousands of sites. The vulnerability, tracked as CVE-2026-3300, allows unauthenticated users to inject PHP code through form fields and gain full control of the affected installations. Initial reports from Wordfence show a sharp rise in exploitation attempts beginning in early April 2026. Security teams worldwide are urged to treat this as an active threat requiring immediate mitigation.
The root cause lies in the process_filter() function, which takes user‑entered values and directly concatenates them into a PHP eval statement without adequate sanitisation. Because the function fails to escape single quotes, an attacker can break out of the intended string context and inject arbitrary PHP commands. This flaw resides in the plugin’s calculation feature, where users expect numeric input but can instead submit malicious payloads.
The vulnerability received a CVSS base score of 9.8, reflecting its potential for complete compromise of confidentiality, integrity and availability. No authentication is required, making the attack vector remotely exploitable over the internet.
All versions of Everest Forms Pro prior to 1.9.13 are affected, meaning any site running 1.9.12 or earlier is vulnerable. The developers issued a patched version, 1.9.13, on 18 March 2026, which removes the dangerous concatenation logic. Since the public disclosure, Wordfence’s firewall logs have shown more than twenty‑nine thousand blocked attempts, with a pronounced peak on 16 May 2026.
Attackers have leveraged the flaw to create hidden administrator accounts, using names such as diksimarina, to retain access even after the initial injection. These accounts often go unnoticed unless administrators routinely audit their user lists.
Threat intelligence sources have not yet identified a specific group behind the wave of attacks, but the automated nature of the probes points to widely available exploit scripts being used by opportunistic actors. The Wordfence blog post provides a timeline of the activity and notes that the patch has been available for over two months, yet a significant number of installations remain outdated. This delay gives attackers a wide window to plant backdoors, exfiltrate data or use the compromised sites for further malicious campaigns. Administrators should assume that any site running a vulnerable version may already be compromised.
The first step for defenders is to upgrade the Everest Forms Pro plugin to version 1.9.13 or newer, which eliminates the vulnerable process_filter() implementation. After the update, site owners should examine the wp_users table for any administrator accounts that were not created through legitimate channels and delete them immediately. It is also advisable to reset passwords for all privileged accounts and to enable two‑factor authentication where possible.
Reviewing access logs for unusual POST requests to the plugin’s admin‑ajax.php endpoint can help detect ongoing exploitation attempts. Finally, clearing any unknown files from the wp‑content directory and re‑installing core WordPress files ensures that no web‑shells remain.
Deploying a web application firewall that inspects and blocks malicious payloads sent to form endpoints provides interim protection while the patch is rolled out across all environments. Maintaining an inventory of all installed plugins and themes, and checking them against vendor security advisories on a regular basis, reduces the likelihood of overlooking vulnerable components. Applying the principle of least privilege to WordPress roles limits what an attacker can achieve even if they manage to execute code.
Staying subscribed to trusted security feeds, such as the Wordfence threat intelligence feed, helps organisations react swiftly to newly disclosed flaws.