Loading vulnerability…
Unauthenticated RCE in Everest Forms Pro Complex Calculation
CVE-2026-3300 is a critical remote code execution vulnerability in the Everest Forms Pro plugin for WordPress affecting all versions up to and including 1.9.12. The flaw is in the Calculation Addon's process_filter() function, which constructs a PHP code string by concatenating user-submitted form field values and then executes that string with eval(). Although input is passed through sanitize_text_field(), that sanitization is insufficient for PHP code context and does not escape single quotes and related syntax-significant characters. As a result, an unauthenticated attacker can submit crafted input that breaks out of the intended string context and injects arbitrary PHP code. Exploitation is possible through string-type form fields, including text, email, URL, select, and radio fields, when the targeted form uses the Complex Calculation feature.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the server in the context of the WordPress application, leading to complete site compromise. Reported post-exploitation outcomes include creation of rogue administrator accounts, deployment of webshells and backdoors, modification of themes or plugins, access to or exfiltration of site and database data, and establishment of persistent access for further malicious activity.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling forms that use the Complex Calculation feature or disabling the vulnerable plugin functionality entirely until the update can be applied. Restrict public access to affected forms where feasible, deploy a web application firewall or equivalent virtual patching, and closely monitor for suspicious form submissions and unauthorized administrative changes. Mitigation is only temporary; updating to the fixed version is required to fully address the vulnerability.
Patch, then assume compromise.
Upgrade Everest Forms Pro to version 1.9.13 or later, which fixes the vulnerable code path. Because the vulnerability has been actively exploited, remediation should also include incident response steps on previously exposed systems: review WordPress administrator accounts for unauthorized additions, inspect themes and plugins for malicious modifications, search for webshells or other persistence mechanisms, rotate credentials associated with the site and hosting environment, and assume database contents may have been accessed if compromise is suspected.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
67 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.