Hackers Exploit Everest Forms Pro Flaw to Take Over WordPress Sites
Summary
Wordfence reports active exploitation of CVE-2026-3300, an unauthenticated code-execution flaw in Everest Forms Pro 1.9.12 and earlier. Attackers are creating rogue administrator accounts; a patch was released March 18.
Key points
- CVE-2026-3300 affects Everest Forms Pro version 1.9.12 and earlier.
- The flaw is in the Complex Calculation feature, which inserts form input into PHP code executed with eval().
- Wordfence says attackers can exploit the flaw without authentication to execute arbitrary code.
- Wordfence telemetry indicates exploitation began April 13 and its firewall blocked more than 29,300 attempts.
- Reported attacks create an administrator account named “diksimarina.”
- The developer released a patch on March 18; Wordfence recommends blocking offending IPs and reviewing logs and administrator accounts.
Article Details
- Vulnerability Types
- Unauthenticated arbitrary code execution through unsanitized input passed to PHP eval()
- Severity
- Critical
- Affected Versions
- Everest Forms Pro 1.9.12 and earlier
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Block the reported malicious IP addresses.
- Review logs and administrator accounts for suspicious activity, including accounts containing the string “diksimarina.”
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 202[.]56[.]2[.]126 | Wordfence identified this IP address as a source of exploitation attempts against the vulnerability. |
| IPV4 | 209[.]146[.]60[.]26 | Wordfence identified this IP address as a source of exploitation attempts against the vulnerability. |
MITRE ATT&CK
T1059 · Command and Scripting InterpreterAttackers inject PHP statements that the plugin executes with eval() when processing a form.T1136.001 · Local AccountThe injected PHP calls wp_insert_user() to create a rogue administrator account.T1190 · Exploit Public-Facing ApplicationAttackers exploit the Everest Forms Pro vulnerability through a website-facing plugin to gain code execution.
CVE
People
Vendors
Products
Everest FormsHackers are actively exploiting CVE-2026-3300 in the Everest Forms Pro plugin to gain unauthenticated code execution and create rogue administrator accounts on WordPress sites.Everest Forms ProHackers are actively exploiting CVE-2026-3300 in the Everest Forms Pro plugin to gain unauthenticated code execution and create rogue administrator accounts on WordPress sites.WordPressHackers are actively exploiting CVE-2026-3300 in the Everest Forms Pro plugin to gain unauthenticated code execution and create rogue administrator accounts on WordPress sites.