Critical RCE in Everest Forms Pro Plugin Actively Exploited on WordPress Sites
Active Exploitation · 2 sources · Updated 2mo ago · First seen May 16, 2026
Attackers have been actively exploiting CVE-2026-3300, a critical remote code execution flaw in the Everest Forms Pro WordPress plugin, to compromise vulnerable websites. The bug affects all versions through 1.9.12 and originates in the plugin’s Calculation add-on, where attacker-controlled input is passed into PHP’s eval() function without proper escaping of single quotes, allowing unauthenticated attackers to execute arbitrary PHP code on target sites.
Security researchers reported that exploitation has enabled full site takeover, including the creation of rogue administrator accounts and deployment of webshells. Wordfence said it observed attacks beginning on April 13 and blocked more than 29,300 exploit attempts, with a notable spike in activity on May 16. Reported indicators of compromise include an administrator account named "diksimarina", the email diksimarina@gmail.com, and requests originating from 202.56.2.126. The vendor, WPEverest, addressed the issue in version 1.9.13, and site administrators were urged to update immediately.
