Actively Exploited Everest Forms Pro Flaw Enables WordPress Site Takeovers

Summary

CVE-2026-3300, a CVSS 9.8 flaw in Everest Forms Pro, allows unauthenticated PHP code injection via Complex Calculation forms. Defiant reports exploitation since April 13 and urges upgrading to version 1.9.13 or later.

Key points

• CVE-2026-3300 (CVSS 9.8) affects Everest Forms Pro and allows unauthenticated remote PHP code injection when a form uses Complex Calculation.
• Attackers can exploit string-type form fields to inject code that executes on the server.
• The flaw can be used to create administrative accounts or deploy web shells, potentially enabling WordPress site takeover.
• Defiant says exploitation began on April 13 and that it has blocked more than 29,000 exploit attempts.
• Defiant reports that most observed attacks attempted to create an administrator account named “diksimarina.”
• The issue was fixed in Everest Forms Pro 1.9.13; users are advised to update to that version or newer and check for unauthorized administrator accounts.

MITRE ATT&CK

CVE

Products

Related Articles

• PHP2Shell Exploitation Roots Palo Alto Firewalls; No WordPress Compromises Reportedsecurityweek.comWordPress · T1190 · T1505.003
• Critical PHP2Shell Flaws Enable Unauthenticated Remote Code Executionreliaquest.comWordPress · T1190 · T1505.003
• Anthropic Reports Increasingly Autonomous AI Misuse in Cybercrime and Espionagegithub.com/jacobdjwilsonWordPress · T1190 · T1505.003
• CyberXero Used Claude Code in Campaign That Stole 628,000+ Ukrainian Recordsthehackernews.comWordPress · T1190 · T1505.003
• CyberXero Used AI-Assisted Campaigns to Target Ukrainian Critical Infrastructuresocradar.ioWordPress · T1190 · T1505.003