Critical Everest Forms Pro flaw exploited to take over WordPress sites
Attackers are exploiting a critical Everest Forms Pro bug to run PHP on WordPress sites and create rogue admin accounts. Wordfence says more than 29,300 attempts were blocked.
Intelligence analysis by GPT-5.4 Mini
A flaw in Everest Forms Pro lets unauthenticated attackers inject PHP through its Complex Calculation feature. Wordfence says the bug is being used in the wild to create administrator accounts and fully take over WordPress sites.
A broken WordPress add-on lets bad guys sneak secret commands into a form, like hiding a note inside a recipe. When the website reads that note, it can accidentally give them the keys to the whole site.
Analysis
What happened
BleepingComputer reports that attackers are actively exploiting CVE-2026-3300 in the commercial Everest Forms Pro WordPress plugin. The issue affects version 1.9.12 and earlier and can be triggered without logging in, which makes it especially dangerous.
The bug sits in the plugin’s Complex Calculation feature. According to the article, the feature takes form input, places it into a PHP code string, and then runs that string with PHP’s eval() function. The problem is that the input filtering used by the plugin does not stop characters like a single quote from breaking out of the intended string. That means an attacker can inject their own PHP code and have the server execute it.
Real-world exploitation
Wordfence telemetry shows the flaw is being used in the wild to create rogue administrator accounts. The report says attackers submit a crafted form value that closes the string, runs PHP that calls wp_insert_user(), and creates a new admin account named diksimarina. The rest of the generated code is commented out so the payload does not break syntax.
The article says the vulnerability was reported by researcher h0xilo in February, and the developer released a fix on March 18. Wordfence says active exploitation began on April 13, with more than 29,300 blocked attempts.
Wordfence also says the activity mainly comes from two IP addresses, 202.56.2[.]126 and 209.146.60.26, and recommends blocking them while reviewing logs and administrator accounts for suspicious activity, especially the string diksimarina.
Key points
- CVE-2026-3300 affects Everest Forms Pro 1.9.12 and earlier.
- The flaw can be exploited without authentication to execute arbitrary PHP on the server.
- Wordfence says attackers are using it to create rogue administrator accounts.
- The developer released a patch on March 18, and exploitation began on April 13.
- Wordfence says more than 29,300 exploit attempts were blocked.
The plugin was patched on March 18, so sites that update quickly can close off the attack path. Wordfence also provides indicators of compromise and IP addresses that defenders can use to hunt for signs of abuse.
Sites that stay unpatched can be fully taken over, letting attackers create admin accounts, change content, install plugins, and plant backdoors. If operators miss the signs in logs or admin lists, the compromise can persist unnoticed.
