Critical Remote Code Execution in Everest Forms Pro WordPress Plugin (CVE‑2026‑3300) Enables Admin Account Creation

Critical Remote Code Execution in Everest Forms Pro WordPress Plugin (CVE‑2026‑3300) Enables Admin Account Creation

What It Is – A remote code execution flaw in the Complex Calculation addon of the Everest Forms Pro WordPress plugin allows an attacker to inject arbitrary PHP via form fields. The vulnerable process_filter() function concatenates unescaped user input into a string that is later executed with eval().

Exploitability – Public exploits have been observed since 13 April 2026; Wordfence blocked >29 k attempts. A proof‑of‑concept payload creates a new WordPress administrator account. CVSS (estimated) ≈ 9.8 (Critical).

Affected Products – Everest Forms Pro (including the Calculation Addon) for WordPress, versions prior to the March 18 2026 patch.

TPRM Impact – Organizations that embed the plugin on client‑facing sites inherit a supply‑chain risk: a compromised third‑party site can be used to pivot into partner networks, exfiltrate data, or host ransomware.

Recommended Actions –

1. Immediately update Everest Forms Pro to the March 18 2026 patch or later.
2. Conduct a full inventory of WordPress sites using the plugin and verify version compliance.
3. Audit existing WordPress user accounts for unauthorized administrators; remove any unknown accounts.
4. Deploy WAF/IPS rules to block suspicious payloads (e.g., single‑quote followed by wp_insert_user).
5. Enable logging of eval()‑related errors and monitor for the ADMINCREATED/ADMINEXISTS responses.
6. Review and harden WordPress file permissions; consider disabling the Calculation Addon if not required.

Source: Security Affairs – Everest Forms Pro WordPress Flaw is Handing Attackers Admin Access (CVE‑2026‑3300)