Everest Forms Pro Flaw Is Being Exploited to Create Rogue WordPress Admins

The newest WordPress plugin emergency is not a theoretical scanner finding. It is a form feature being turned into administrator access.

How a form calculation bug becomes site takeover

The vulnerability is CVE-2026-3300, a remote-code-execution bug in Everest Forms Pro versions up to and including 1.9.12; the U.S. National Vulnerability Database describes the flaw as PHP code injection in the Calculation Addon’s process_filter() function and assigns it a 9.8 critical CVSS score. NVD says unauthenticated attackers can exploit forms using the “Complex Calculation” feature by submitting crafted values in string-type fields.

Public input reaches eval()

That matters because the affected feature sits in the normal path of a public form. In NVD’s description, user-submitted field values were concatenated into a PHP code string before being passed to eval(), while sanitize_text_field() did not escape characters that matter inside PHP string syntax. The result is a path from a crafted form submission to arbitrary PHP execution on the server.

Exploitation is already being reported

BleepingComputer reported that the flaw is already being exploited in the wild, citing Wordfence firewall and malware-scanner telemetry. According to that report, attacks have been observed creating rogue WordPress administrator accounts, including attempts associated with the username string “diksimarina.”

Why this one is urgent

Administrator access changes the severity

Plugin vulnerabilities are often framed as “update when convenient.” This one is harder to treat casually because successful exploitation can hand an attacker administrator-level control of the site. Once an attacker has that role, they can change content, install additional plugins or themes, plant webshells, create persistence, and access data through the compromised WordPress instance.

The Pro add-on needs the security release

Everest Forms’ public changelog lists version 1.9.13 with a “Security issue” fix after 1.9.12. The vendor changelog shows 1.9.13 as the next Pro release after 1.9.12 and includes the security fix in that release’s notes. Site owners running Everest Forms Pro should confirm that the Pro add-on, not only the free Everest Forms plugin, is updated past the affected line.

What site owners should check now

Patch first, then look for compromise

The practical response is straightforward: update Everest Forms Pro, then look for evidence that the site was already touched. Administrators should review WordPress users for unexpected administrator accounts, especially accounts created after public exploitation began. They should also search webserver logs for suspicious form submissions, unexpected PHP execution paths, and the indicator strings highlighted in the public reporting.

Because the issue depends on forms using Complex Calculation, not every Everest Forms installation has the same exposure. But the safe posture is to patch first and scope later. If the plugin is present and the Pro version is 1.9.12 or older, the site should be treated as exposed until logs, users, and file changes say otherwise.

Paid add-ons need their own inventory

This incident is also a reminder that WordPress security is not only about core updates. A commercial add-on connected to public forms can become the highest-risk component on a site, and it may not be visible in a basic free-plugin inventory. For agencies and site owners, the next checklist item is simple: inventory paid add-ons, verify their update channels still work, and alert on new administrator creation.

Featured image: “Phone security” by Ervins Strauhmanis, licensed under CC BY 2.0 via Flickr.