Critical WordPress Plugin Bug Actively Exploited to Inject PHP Code

Key Takeaways

• A critical remote code execution (RCE) vulnerability in the Everest Forms Pro WordPress plugin is under active exploitation.
• The flaw, CVE-2026-3300 (CVSS 9.8), allows unauthenticated attackers to inject and execute arbitrary PHP code on affected websites.
• All versions of Everest Forms Pro up to 1.9.12 are vulnerable; a patch (version 1.9.13) was released on March 18, 2026.
• Attackers are primarily using the vulnerability to create unauthorized administrator accounts and establish webshells.

Active Exploitation of Critical WordPress Plugin Flaw Confirmed

Cybersecurity researchers have confirmed ongoing, widespread exploitation of a severe remote code execution (RCE) vulnerability impacting the Everest Forms Pro plugin for WordPress. This critical flaw enables attackers, even without authentication, to inject and execute arbitrary PHP code on websites utilizing the vulnerable plugin versions.

Designated as CVE-2026-3300, the vulnerability carries a CVSS score of 9.8, indicating its extreme severity. It affects all iterations of Everest Forms Pro up to and including version 1.9.12. Despite the vendor releasing a patch on March 18, 2026, and public disclosure occurring on March 30, 2026, malicious actors commenced active targeting of unpatched installations by April 13, 2026.

According to data from Wordfence threat intelligence, over 29,300 exploitation attempts have been successfully blocked. A significant surge in activity was observed on May 16, with more than 17,900 attacks recorded on that single day.

Technical Deep Dive: The “Complex Calculation” Flaw

The core of the vulnerability resides within the plugin’s “Complex Calculation” feature, specifically within the process_filter() function. This function is designed to dynamically generate PHP code by combining user-provided form inputs, which is then executed using the inherently dangerous eval() function.

While the plugin attempts to sanitize input using sanitize_text_field(), this function critically fails to escape single quotes. This oversight allows attackers to break out of the intended string context within the dynamically constructed PHP code and inject their own malicious commands. This design flaw permits unauthenticated attackers to craft harmful payloads through standard form fields like text, email, URL, select, and radio inputs.

By inserting a single quote, followed by arbitrary PHP code, and then a comment sequence, threat actors can manipulate the server’s generated code, achieving remote code execution. Common attack patterns observed indicate that the primary objective of these exploits is to create unauthorized administrator accounts. For instance, attackers have been seen injecting PHP code that calls WordPress’s wp_insert_user() function to establish a new admin user with the username “diksimarina.”

Once administrative privileges are obtained, attackers can further compromise the website by uploading webshells, altering site content, deploying backdoors, or escalating their access within the hosting environment.

Indicators of Compromise and Malicious IPs

Security telemetry has identified several IP addresses consistently involved in exploiting the Everest Forms Pro vulnerability, generating thousands of malicious requests. These IPs serve as crucial indicators of compromise (IOCs) for blocking and monitoring efforts:

• 202.56.2[.]126: Responsible for tens of thousands of blocked requests.
• 209.146.60[.]26: Associated with several thousand exploit attempts.
• 15.235.166[.]18: Generated hundreds of malicious requests.
• 2402:1f00:8000[:]800::40db: Active IPv6 exploit activity.
• 185.78.165[.]153: Confirmed hostile scanning activity.

Attacks typically target the /wp-admin/admin-ajax.php endpoint, submitting specially crafted POST requests designed to trigger the vulnerable calculation logic. The unauthenticated nature of the vulnerability and its remote exploitability through publicly accessible forms make it a significant risk, particularly for websites with the Complex Calculation feature enabled.

Wordfence customers received early protection via firewall rules implemented on February 27, 2026, with free users gaining protection from March 29, 2026. However, relying solely on virtual patching is not a complete solution. Updating to the latest patched version, 1.9.13, remains essential for full mitigation.

What You Should Do

• Update Immediately: Website administrators must update the Everest Forms Pro plugin to version 1.9.13 or higher without delay.
• Audit User Accounts: Review all user accounts for any unauthorized administrator accounts, especially those with unusual usernames like “diksimarina.”
• Inspect Server Logs: Examine server and WordPress access logs for suspicious requests targeting /wp-admin/admin-ajax.php, particularly those originating from the malicious IP addresses listed above.
• Implement Web Application Firewall (WAF): Utilize a robust WAF to provide an additional layer of protection against known and emerging threats.
• Regular Backups: Ensure you have recent, verified backups of your website to facilitate recovery in case of a compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.