Critical RCE Vulnerability CVE-2026-3300 in Everest Forms Pro

A critical Remote Code Execution (RCE) vulnerability, tracked as CVE-2026-3300, is currently being exploited in the wild against the Everest Forms Pro WordPress plugin. The flaw, carrying a CVSS score of 9.8, stems from improper input validation within the plugin's "complex calculation" feature. Unauthenticated attackers can leverage this vulnerability to execute arbitrary code, facilitating complete administrative takeover of affected WordPress environments. With approximately 4,000 active installations vulnerable, threat actors are utilizing specific payload patterns to trigger the calculation engine, leading to webshell deployment, unauthorized user creation, and potential data exfiltration. Immediate patching to version 1.9.13 or higher is required to mitigate this high-risk threat.

• Vulnerability Overview: Critical RCE in WordPress Plugin

  • Identifier: CVE-2026-3300.
  • Severity: Critical, CVSS v3.1 score of 9.8.
  • Affected Component: Everest Forms Pro (versions $\le$ 1.9.12).
  • Exploitation Status: Active, unauthenticated exploitation confirmed in the wild.

• Vulnerability Mechanics: Calculation Engine Flaw

  • Root Cause: Improper handling of user-supplied inputs within the "complex calculation" feature.
  • Attack Vector: Maliciously crafted inputs passed to the plugin's calculation engine to trigger RCE.
  • Execution Flow: Vulnerable inputs allow attackers to bypass sanitization and execute commands at the web server level.
  • Patch Delta: Version 1.9.13 introduces robust input validation and sanitization for all calculation parameters.

• Impact and Exploitation: High-Scale Compromise Risk

  • Attack Surface: Estimated 4,000 active WordPress installations globally.
  • Post-Exploitation: Observed patterns include webshell deployment and the creation of unauthorized administrative accounts.
  • Data Risk: Potential for full database exfiltration, total loss of integrity, and lateral movement within the host environment.

• Detection and Mitigation: Immediate Response Actions

  • Primary Mitigation: Update Everest Forms Pro to version 1.9.13 or later immediately.
  • Detection Indicators: Monitor for anomalous processes triggered by the calculation engine and unexpected administrative user creation.
  • Forensic Artifacts: Inspect web server logs for suspicious payloads targeting the calculation feature and audit for newly deployed webshells.

• Conclusion: Urgent Remediation Required

  • High priority for all organizations utilizing Everest Forms Pro within their WordPress ecosystem.
  • Active exploitation necessitates immediate patching to prevent complete site compromise.