A critical PHP code injection vulnerability in the Everest Forms Pro WordPress plugin (CVE-2026-3300, CVSS 9.8) is under active exploitation. Because the flaw sits inside the plugin's Calculation Addon, any form field that accepts string input becomes an injection point — no authentication required. Attackers that land a successful hit can execute arbitrary PHP on the web server, create rogue administrator accounts, and install persistent web shells.
Wordfence has blocked more than 29,300 exploit attempts since attacks began on April 13, 2026. A patch shipping in version 1.9.13 has been available since March 18, yet a significant share of the plugin's roughly 4,000 active installations remain unpatched. If your site runs Everest Forms Pro 1.9.12 or earlier with the Complex Calculation feature enabled, treat this as an emergency patching event.
◈ Table of Contents
Background & Affected Versions
PHASE 01Everest Forms Pro is a WordPress form-building plugin used primarily by small to mid-sized businesses for contact forms, surveys, and data collection. Its Complex Calculation feature lets site owners build formula-driven form fields — the source of the vulnerability.
| Field | Detail |
|---|---|
| CVE ID | CVE-2026-3300 |
| CVSS Score | CRITICAL 9.8 |
| CVSS Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Affected Versions | Everest Forms Pro <= 1.9.12 |
| Patch Version | 1.9.13 (released March 18, 2026) |
| Authentication Required | None — unauthenticated |
| Vulnerability Class | CWE-94 — PHP Code Injection via eval() |
| Reporter | Wordfence Threat Intelligence |
| Active Exploitation | Yes — confirmed since April 13, 2026 |
How the Exploit Works
PHASE 02The Calculation Addon's process_filter() function builds a PHP code string by concatenating raw values from submitted form fields, then passes that string directly to PHP's eval(). The only sanitisation applied is WordPress's sanitize_text_field(), which strips HTML tags and extra whitespace but does not escape single quotes, semicolons, or other PHP syntax characters — making PHP code injection trivial.
The trigger condition is a form that uses the Complex Calculation feature. If a site has no such form, the attack surface does not exist. However, determining whether any form uses this feature requires manual inspection of every active form configuration.
ATTACK CHAIN — CVE-2026-3300 · UNAUTHENTICATED PHP INJECTION TO FULL SERVER COMPROMISE
The exploit requires a single unauthenticated HTTP POST to any form endpoint that uses the Complex Calculation feature. The PHP payload is passed as the value of any string-type field (text, email, URL, select, or radio). Once eval() processes the injected code, the attacker has full PHP execution context on the server — the same privilege level as the web server process running WordPress.
Active Exploitation Evidence
PHASE 03According to Wordfence, exploitation began on April 13, 2026 — nearly four weeks after the patch was released. More than 29,300 attack attempts have been blocked to date, with 16 attempts recorded in the 24 hours preceding the June 5 advisory. The concentrated targeting of this specific plugin suggests an organised scanning campaign rather than opportunistic exploitation.
- 29,300+ blocked exploit attempts as of June 5, 2026
- Exploitation onset: April 13, 2026 (25 days post-patch)
- Most common payload: create WordPress admin user "diksimarina"
- Admin email in payload: [email protected]
- Attack sources span 5 distinct IP addresses (IPv4 and IPv6)
The rogue admin username "diksimarina" serves as a reliable detection signal. A search across your WordPress user table or access logs for this string is a strong indicator of successful exploitation. Check wp_users for any account with this name and immediately revoke access if found.
Indicators of Compromise
PHASE 04The following IP addresses were identified as attack sources by Wordfence. Block these at the WAF or firewall level and search web access logs for POST requests originating from these addresses to any Everest Forms endpoint.
| IP Address | Type | Action |
|---|---|---|
| 202.56.2.126 | IPv4 | Block + log review |
| 209.146.60.26 | IPv4 | Block + log review |
| 15.235.166.18 | IPv4 | Block + log review |
| 2402:1f00:8000:800::40db | IPv6 | Block + log review |
| 185.78.165.153 | IPv4 | Block + log review |
| Artefact | Value | Significance |
|---|---|---|
| Rogue admin username | diksimarina | High-confidence compromise indicator |
| Rogue admin email | [email protected] | Attacker-controlled inbox for password resets |
| Injection vector | POST body, any string form field | Look for PHP syntax in form submissions |
| Vulnerable endpoint pattern | /wp-admin/admin-ajax.php or custom form action | POST to form processing endpoints |
Detection & Hunt Queries
PHASE 05Mitigation & Patch
PHASE 06- 1Update immediately. Upgrade Everest Forms Pro to version 1.9.13 or later via WordPress Admin → Plugins → Updates. The patch was released March 18, 2026.
- 2Check for compromise. Query your WordPress user table for accounts named "diksimarina" or using "[email protected]". If found, the site was successfully exploited — treat as a full incident.
- 3Audit active forms. Identify any form using the Complex Calculation feature. If the plugin cannot be updated immediately, disable the Calculation Addon through the plugin settings as a temporary workaround.
- 4Block attacker IPs. Add the five known attacker IPs to your WAF block list and review access logs for POST requests from those addresses over the past 60 days.
- 5Scan for web shells. Run a file integrity check or malware scan on the WordPress installation. Look for unexpected PHP files in
wp-content/uploads/andwp-content/themes/, which are common web shell drop locations. - 6Review all admin accounts. Export the full list of WordPress administrators and verify each account is legitimate. Revoke any unexpected account with administrator privileges.
If you find any evidence of successful exploitation — rogue admin accounts, unfamiliar files, or unexpected outbound connections — treat this as a full incident response engagement. Patching alone does not remediate a compromise; assume the attacker may have already established persistence.
MITRE ATT&CK Mapping
PHASE 07| Tactic | Technique | ID | Detail |
|---|---|---|---|
| Initial Access | Exploit Public-Facing Application | T1190 | Unauthenticated POST to Everest Forms endpoint |
| Execution | Server-Side Scripting (PHP eval) | T1059.003 | PHP code injection via unsanitised eval() |
| Persistence | Create Account — Local Account | T1136.001 | Rogue WordPress admin account creation |
| Persistence | Server Software Component — Web Shell | T1505.003 | PHP web shell deployment via RCE |
| Privilege Escalation | Valid Accounts — Local Accounts | T1078.003 | Attacker-created admin account used for escalated access |
| Defense Evasion | Masquerading | T1036 | Web shell named to blend with legitimate WordPress files |
Sources & References
PHASE 08Check your site's exposure now with the CyberHawk IOC Scanner
Paste the attacker IP addresses or the "diksimarina" username string into the CyberHawk IOC Scanner to cross-reference against live threat intelligence feeds and confirm whether your infrastructure has interacted with these indicators.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."