PT-2026-29180 · WordPress · Everest Forms Pro+1
CVE-2026-3300
·
Published
2026-03-31
·
Updated
2026-06-28
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Everest Forms Pro versions prior to 1.9.13
Description
Unauthenticated attackers can achieve remote code execution via PHP code injection in the Everest Forms Pro plugin for WordPress. The issue exists within the Calculation Addon's
process filter() function, which concatenates user-submitted form field values into a PHP code string and passes them to eval() without proper escaping. Although the sanitize text field() function is used, it fails to escape single quotes and other characters critical to PHP code context. This allows attackers to execute arbitrary PHP code by submitting crafted values in any string-type form field (such as text, email, URL, select, or radio) when a form utilizes the Complex Calculation feature. Approximately 4,000 active installations are potentially affected. Real-world exploitation has been confirmed, with over 29,300 blocked attempts reported, leading to the creation of unauthorized administrator accounts, deployment of webshells, and full site takeovers.Recommendations
Update Everest Forms Pro to version 1.9.13 or later.
As a temporary mitigation, deploy a ModSecurity rule to block known injection vectors.
Audit server logs for anomalous POST requests to plugin endpoints containing PHP function calls such as
eval, base64 decode, system, or exec in form field data.
Scan the wp-content/uploads and wp-content/plugins/everest-forms-pro directories for unauthorized webshells.
Review the list of administrator accounts for any unauthorized additions.Fix
RCE
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Calculation Addon
Everest Forms Pro