{"id":1177,"date":"2026-06-05T09:02:35","date_gmt":"2026-06-05T09:02:35","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1177"},"modified":"2026-06-05T09:02:35","modified_gmt":"2026-06-05T09:02:35","slug":"hackers-exploit-critical-everest-forms-pro-wordpress-plugin-flaw-to-take-over-sites","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1177","title":{"rendered":"Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites"},"content":{"rendered":"
\n
<\/a><\/div>\n

Threat actors are actively exploiting a critical security flaw in Everest Forms Pro, a WordPress plugin with about 4,000 active installations, to execute arbitrary code, leading to a complete site compromise.<\/p>\n

The vulnerability in question is CVE-2026-3300 (CVSS score: 9.8), a remote code execution bug impacting all versions of the plugin up to, and including, 1.9.12. A patch for the flaw was released on March 18, 2026, with version 1.9.13.<\/p>\n

\u00abThis is due to the Calculation Addon’s process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(),\u00bb Wordfence said<\/a>.<\/p>\n

\u00abThe sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the ‘Complex Calculation’ feature.\u00bb<\/p>\n

Successful exploitation of the vulnerability could allow unauthenticated bad actors to execute arbitrary PHP code on the server, permitting them to create rogue administrator accounts, deploy web shells, and open other ways to burrow deeper into the server and establish persistent footholds.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

According to the WordPress security company, attackers have been observed exploiting the flaw starting April 13, 2026. More than 29,300 exploit attempts targeting the defect have been blocked to date. Of these, 16 attack attempts<\/a> occurred in the last 24 hours. The most common payload involves attempts to create an administrator account named \u00abdiksimarina\u00bb (email address: diksimarina@gmail.com) on the compromised site.<\/p>\n

<\/p>\n

These attack efforts have originated from the following IP addresses –<\/p>\n