Critical Everest Forms Pro WordPress Flaw CVE-2026-3300 Exploited for Two Months as Wordfence Blocks 29,300 Attacks
An unauthenticated PHP code-injection bug in the Everest Forms Pro plugin, patched in March, has been exploited since April 13 to plant rogue administrator accounts on WordPress sites.
Overview
Attackers have spent two months exploiting a critical remote code execution flaw in Everest Forms Pro, a commercial WordPress form-builder plugin, to seize control of vulnerable websites. The vulnerability, tracked as CVE-2026-3300, can be leveraged without authentication to execute arbitrary code on the server, according to The Hacker News. It carries a CVSS score of 9.8, according to Infosecurity Magazine, placing it at the top of the severity scale.
The flaw was patched in March, but in-the-wild exploitation began on April 13, 2026, as reported by Infosecurity Magazine. Since then, the security firm Wordfence says its firewall has blocked more than 29,300 exploit attempts against the bug, according to Infosecurity Magazine.
What We Know
The National Vulnerability Database assigns CVE-2026-3300 a base score of 9.8 (critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and classifies it as CWE-94, improper control of generation of code, according to NVD. The flaw affects all versions of the plugin up to and including 1.9.12, according to NVD.
The vulnerability sits in the plugin’s Complex Calculation feature, according to The Hacker News. Per the NVD entry, the root cause is the Calculation Addon’s process_filter() function, which concatenates user-submitted form-field values into a PHP code string and then runs that string through PHP’s eval() function without proper escaping, according to NVD.
The specific weakness is in how the input is sanitized. User input is passed through the sanitize_text_field() function, which does not escape single quotes or other characters that influence PHP syntax, according to The Hacker News. Because of that gap, an attacker can open a value with a quote, break out of the wrapping string, and inject PHP, according to Infosecurity Magazine. The result, as Wordfence describes it, allows “unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field,” according to SecurityWeek.
In the observed attacks, the injected code creates a new administrator account with the username diksimarina, according to The Hacker News. The rogue account is tied to the email address diksimarina@gmail.com, according to Infosecurity Magazine. A single IP address, 202.56.2.126, was the source of more than 26,300 of the blocked attempts, according to Infosecurity Magazine.
The Timeline
Everest Forms Pro is built by developer WPEverest and has roughly 4,000 active installations, according to Infosecurity Magazine. The vulnerability was reported to Wordfence’s bug bounty program by a researcher using the handle h0xilo, according to Infosecurity Magazine.
The developer released a patch on March 18, according to The Hacker News, shipping the fix in version 1.9.13, according to Infosecurity Magazine. Despite the fix being available, exploitation did not start until April 13, according to The Hacker News.
The attack volume has not been steady. A surge on May 16 accounted for over 17,900 of the blocked attempts in a single day, according to Infosecurity Magazine.
What We Don’t Know
The public reporting does not establish how many of the roughly 4,000 sites running the Pro plugin remain unpatched, nor how many were successfully compromised before site owners updated. The identity and motivation of the actors behind the diksimarina campaign are likewise unconfirmed.
Analysis
The pattern here is a familiar one for the WordPress ecosystem: a vulnerability patched well before mass exploitation, followed by an automated campaign that hunts for the sites that never updated. The fix shipped on March 18, yet attacks only began on April 13, according to The Hacker News — a window that maps closely to the time it takes opportunistic actors to weaponize a published fix. For administrators, the remediation is straightforward: update to version 1.9.13 or later and audit the user list for any unexpected administrator account, particularly one named diksimarina.