Attackers are actively exploiting a critical vulnerability in the Everest Forms Pro WordPress plugin, tracked as CVE-2026-3300. The flaw has a CVSS score of 9.8 and affects all versions up to and including 1.9.12. A patched version, 1.9.13, was released on March 18, 2026, but vulnerable installations are still being targeted, because naturally patch availability and patch deployment continue to be two very different species. ([The Hacker News][1]) 

Why This Matters 

Everest Forms Pro is used to create forms on WordPress sites, and the vulnerable component is linked to the plugin’s Calculation Addon. According to Wordfence, the issue exists because user-submitted form values are concatenated into PHP code without proper escaping before being passed to eval(). That allows unauthenticated attackers to inject and execute arbitrary PHP code on the server when a form uses the Complex Calculation feature. 

This is especially serious because successful exploitation can lead to complete site compromise. Attackers may create rogue administrator accounts, deploy web shells, modify site content, steal data, inject malicious scripts, redirect visitors, or establish persistent access. In short, a form plugin meant to collect visitor input can become a remote code execution path, which is not exactly the customer engagement strategy anyone asked for. 

Active Exploitation Observed 

The Hacker News reports that exploitation activity began around April 13, 2026, and Wordfence has blocked more than 29,300 exploit attempts so far. The commonly observed payload attempts to create an administrator account named “diksimarina” using a specific email address, showing that attackers are already operationalizing the flaw rather than merely discussing it in theory. 

What Website Owners Should Do 

Website owners using Everest Forms Pro should immediately update to version 1.9.13 or later. They should also review all WordPress administrator accounts, check for unknown users, inspect recently modified plugin and theme files, scan for web shells, review form submission logs, and look for suspicious PHP code or unexpected redirects.

Administrators should also reset passwords, revoke suspicious sessions, enable multi-factor authentication for admin accounts, restrict admin panel access where possible, and ensure clean backups are available. Sites that used the Complex Calculation feature should be treated with extra caution, because that is where the vulnerable attack path exists.

Final Comment 

The Everest Forms Pro vulnerability is another reminder that WordPress plugin security is website security. A single vulnerable plugin can expose the entire server, even if WordPress core is fully updated.

The lesson is simple: update immediately, audit admin accounts, scan for compromise, and monitor suspicious form activity. Any plugin that processes user input, especially one that performs calculations or dynamic logic, must be treated as part of the attack surface. Attackers are not waiting for website owners to catch up. They are already exploiting old versions, because the internet remains a massive museum of unpatched software with contact forms.

Threat actors are actively exploiting a critical security flaw in Everest Forms Pro, a WordPress plugin with about 4,000 active installations, to execute arbitrary code, leading to a complete site compromise. The vulnerability in question is CVE-2026-3300 (CVSS score: 9.8), a remote code execution bug impacting all versions of the plugin up to, and including, 1.9.12. A patch for the flaw was

Source: Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites via The Hacker News — published 05 Jun 2026.