A critical security vulnerability in the Everest Forms Pro WordPress plugin has become the latest target for cybercriminals seeking to compromise websites at scale. The flaw, designated CVE-2026-3300, enables attackers to execute arbitrary code without authentication, effectively handing them the keys to entire WordPress installations.
The Anatomy of a Code Injection Attack
The vulnerability lies within the Complex Calculation feature of Everest Forms Pro, a commercial extension used by website owners to create sophisticated forms for contact, registration, and payment processing. The plugin's fatal flaw stems from how it processes user input through form fields.
When users submit data through forms, the plugin inserts these values into PHP code strings and executes them using PHP's eval() function. While the plugin attempts to sanitize input using WordPress's sanitize_text_field() function, this protection proves insufficient against determined attackers.
The sanitization fails to escape single quotes and other characters that can manipulate PHP syntax, creating a dangerous pathway for code injection.
Attackers exploit this weakness by submitting carefully crafted payloads that begin with a single quote to break out of the intended string context. They then inject malicious PHP statements and use comment markers to neutralize any remaining code that might cause syntax errors.
Real-World Exploitation Patterns
Security researchers have documented active exploitation attempts targeting this vulnerability since April, with threat actors demonstrating a clear preference for creating rogue administrator accounts. The attacks follow a consistent pattern: adversaries submit malicious form data containing PHP code that calls WordPress's wp_insert_user() function to establish new administrative users.
These unauthorized accounts typically use the username 'diksimarina,' providing defenders with a clear indicator of compromise. Once attackers secure administrator privileges, they possess unrestricted access to modify website content, install malicious plugins or themes, establish persistent backdoors, and extract sensitive database information.
Firewall telemetry indicates that exploitation attempts have primarily originated from two specific IP addresses, though additional indicators suggest the campaign may be broader in scope. The concentrated nature of these attacks suggests organized threat actors rather than opportunistic scanning.
Timeline and Response Efforts
The vulnerability was responsibly disclosed through security research channels in February, prompting the plugin developer to release a patched version by mid-March. However, the gap between patch availability and widespread deployment created an opportunity for attackers to exploit unpatched installations.
Despite the patch being available for several weeks, exploitation began in earnest during April, highlighting the persistent challenge of timely security updates across distributed WordPress ecosystems. Security firms have documented over 29,000 blocked attack attempts, indicating the scope and intensity of ongoing exploitation efforts.
Beyond Individual Compromises
The Everest Forms Pro incident illustrates broader systemic vulnerabilities within the WordPress plugin ecosystem. Commercial plugins often handle sensitive operations like payment processing and user registration, making them high-value targets for cybercriminals seeking to compromise business-critical functionality.
The use of eval() functions with user-controlled input represents a fundamental security anti-pattern that continues to surface across various plugin implementations. This vulnerability class enables attackers to transform simple form submissions into complete system compromises.
What You Should Do
Organizations running WordPress installations should treat this incident as a reminder of the critical importance of maintaining current security patches across all plugins and themes. The rapid exploitation following patch release demonstrates that threat actors actively monitor security advisories and move quickly to capitalize on unpatched systems.
