Loading vulnerability…
CVE-2026-3300 is a critical unauthenticated remote code execution vulnerability in the Everest Forms Pro plugin for WordPress affecting all versions up to and including 1.9.12. The flaw is in the Calculation Addon's process_filter() function, which constructs a PHP code string by concatenating user-supplied form field values and then executes that string with eval(). Although input is passed through sanitize_text_field(), that routine does not escape single quotes and other characters significant to PHP code context, allowing an attacker to break out of the intended string boundary and inject arbitrary PHP. Exploitation is possible through crafted submissions to string-type form fields, including text, email, URL, select, and radio fields, when the targeted form uses the Complex Calculation feature.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository is a small standalone Python exploit project for CVE-2026-3300 targeting WordPress Everest Forms Pro <= 1.9.12. Structure is minimal: one executable Python script (cve-2026-3300.py), a README with usage examples, requirements.txt listing requests, and targets.txt containing sample URLs. The script is the clear entry point and implements four main modes: scan, poc, exploit, and reverse. Core capability: the exploit crafts unauthenticated POST requests containing a malicious value in an Everest Forms field parameter to trigger PHP code injection in the vulnerable calculation functionality. The payload generator supports multiple PHP execution primitives (system, exec, passthru, shell_exec) and appends a PWNED marker to help confirm successful execution. The exploit posts either to /wp-admin/admin-ajax.php with action=everest_forms_process_submission or to the site root / as a fallback. Success is inferred from HTTP 200 responses containing PWNED or common command-output indicators such as uid=, root:, www-data, or command not found. Reconnaissance capability: scan() performs lightweight detection by requesting /wp-json/everest-forms/v1/forms and /wp-admin/admin-ajax.php, looking for strings like everest or evf in responses. This is not a pure detector-only repository; it contains active exploitation logic. Post-exploitation capability: reverse mode builds a bash reverse-shell command using the local host IP and a chosen listener port, starts a threaded TCP listener bound to 0.0.0.0, and then reuses the exploit path to execute the reverse-shell command on the target. Batch operation is supported through targets.txt and ThreadPoolExecutor-based concurrency. Overall, this is an operational standalone web exploit/command-execution tool rather than a framework module. It is not heavily weaponized, but it does provide practical exploitation features beyond a simple proof of concept, including target scanning, configurable payload functions, multithreaded batch exploitation, and a basic interactive reverse-shell workflow.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
66 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in Everest Forms Pro mentioned as being under active exploitation elsewhere; cited as part of the broader set of flaws targeted by the crew.
A PHP code injection vulnerability in Everest Forms Pro included in the actor's exploit set.
A comparable vulnerability in the Everest Forms Pro plugin mentioned for threat landscape context; it was actively exploited to hijack vulnerable websites.
An unauthenticated remote code execution vulnerability in Everest Forms Pro versions 1.9.12 and earlier, described as occurring via calculation formula injection.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.