Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites
Hackers are exploiting a critical Everest Forms Pro bug to run code on WordPress sites. The same article also details Stripe-abusing skimmer campaigns and a fake storefront network.
Intelligence analysis by GPT-5.4 Mini
Threat actors are actively exploiting CVE-2026-3300 in Everest Forms Pro, a WordPress plugin with about 4,000 installs, to gain full control of sites. The article also describes ecommerce skimmers that hide behind trusted services like Stripe and Google Tag Manager.
A broken WordPress add-on is letting thieves sneak instructions into a website, like slipping fake notes into a mailbox so the house opens for them. The same article says other criminals are hiding card-stealing code inside trusted services like Stripe to make it harder to spot.
Analysis
WordPress plugin RCE in the wild
The headline issue is CVE-2026-3300, a critical remote code execution flaw in Everest Forms Pro affecting all versions up to 1.9.12. Wordfence says the bug comes from the plugin's Calculation Addon, where user-supplied form values are concatenated into PHP code and passed to eval() without proper escaping. The vendor released version 1.9.13 on March 18, 2026 to patch the flaw.
The practical impact is severe because the attack does not require authentication. According to Wordfence, an attacker can submit a crafted value into a string-type form field, such as text, email, URL, select, or radio, when a form uses the "Complex Calculation" feature. That can let the attacker execute arbitrary PHP on the server, create rogue administrator accounts, deploy web shells, and establish persistence.
Wordfence says exploitation has been observed since April 13, 2026. More than 29,300 exploit attempts have been blocked so far, including 16 attempts in the last 24 hours. A common payload tries to create an admin account named diksimarina with the email diksimarina@gmail.com, and the activity has come from several listed IP addresses.
Skimmers abusing trusted services
The article then shifts to ecommerce skimmer activity. Sansec says one campaign uses Stripe as both a command-and-control channel and a place to store stolen data, while also leaning on Google Tag Manager and Stripe domains that stores often trust by default. On Magento and Adobe Commerce checkout pages, the code loads a skimmer from a Stripe customer account metadata field and saves card and contact details before sending them back to the attacker.
Sansec says it also found a variant using Google Firestore, and another large campaign called GorgonAgora built around 5,714 fake .shop storefronts impersonating major brands. Those stores use the same commerce stack and checkout SDK, then exfiltrate card data to a server in Moldova over encrypted WebSocket traffic, including a live 3D Secure relay to help transactions complete invisibly.
Key points
- CVE-2026-3300 is a critical remote code execution flaw in Everest Forms Pro up to version 1.9.12.
- Wordfence says attackers can exploit the bug without authentication by abusing the plugin's calculation feature.
- More than 29,300 exploit attempts have been blocked, with activity observed since April 13, 2026.
- A common attack payload tries to create an admin account named diksimarina.
- The article also describes skimmer operations abusing Stripe, Google Tag Manager, and Google Firestore.
The flaw has a fixed version, so sites that update to 1.9.13 can block the RCE path. The article also shows active detection is working, with Wordfence already blocking large numbers of attempts.
Sites that stay on vulnerable versions can be fully taken over, which opens the door to rogue admins, web shells, and persistent compromise. The skimmer campaigns show attackers are also using trusted third-party services and encrypted channels, which can make theft harder to detect and filter.
