CVE-2026-3300: the critical vulnerability of Everest Forms Pro that allows remote code execution and requires immediate patch

A critical vulnerability in the Everest Forms Pro plugin for WordPress is being exploited in nature and puts at risk full sites: this is about CVE-2026-3300, a CVSS 9.8 score failure that allows remote code execution in any plugin installation up to and including 1.9.12; the manufacturer published a patch in version 1.9.13 on March 18, 2026. According to the technical analysis, the root of the problem is the way in which the Calculus Addon contains values sent by users in a PHP chain and evaluates them with oval () taking advantage that the sanitization used does not prevent the injection of characters as simple quotes, which makes it easier for an unauthenticated attacker to run arbitrary PHP.

The consequences of successful exploitation are severe: the creation of administrative accounts remotely, the deployment of web shells, data exfiltration and persistence on the server. Response equipment and security tools have recorded tens of thousands of operating attempts - more than 29,300 blockades reported to date - and continuous activity since mid-April 2026, with repeated payloads trying to create an administrative account identified by the name "diksimarina." Specific sources of attack have also been observed from public IP addresses that are being monitored by security teams.

If your site uses Everest Forms Pro, the first and absolute priority is to apply the patch to version 1.9.13 or higher. If you cannot update immediately, disable the plugin or at least the "Complex Calculation" Addon / feature until you confirm that the installation is clean and patched: the exposure window is short and the full server engagement risk is high.

Beyond updating, there are essential response steps: inspect the list of administrative users and search for new or unauthorized accounts (e.g. the "diksimarina"), review the access and PHP records for suspicious entries around the attack dates, and scan the file system for web shells or recently added PHP files. Restore from verifiable backups if you detect irreversible modification, and change credentials and API keys that may have been exposed. Implement or adjust WAF rules to block payload patterns in form fields can mitigate additional exploitation while applying the patch.

This incident comes along with payment skimming investigations that show increasingly ingenious tactics: Sansec has documented campaigns that abuse legitimate services such as Google Tag Manager and Stripe to house and extract malicious code, taking advantage that both domains are reliable by default in many online stores and therefore difficult to block with CSP or traditional network filters. In these cases, the attacker uses GTM to load a loader and stores the skimmer in metadata from a Stripe client account, transforming a payment provider's infrastructure into a covert command and exfiltration channel. More details are available in the analyses published by Sansec and other researchers: Sansec report and vulnerability monitoring can be found in the vulnerability database: CVE-2026-3300 in NVD.

For electronic stores and developers, this involves rethinking the implicit confidence in third parties: strictly control who can edit GTM containers, apply multifactor access controls for accounts that manage labels and keys, audit containers and metadata content in external services such as Stripe, and limit which domains and endpoints can be loaded on your site through more restrictive CSP policies and resource integrity monitoring. In addition, rote and revoke API keys and supplier credentials if you detect abnormal activity or possible malicious use.

From the operational point of view, activate malware scans on the server and on WordPress (plugins such as those of reputable security firms can help detect shells and malicious PHP), enable detailed registration and retention of logs to enable forensic analysis, and configure alerts that detect changes in the file tree, new accounts with privileges and traffic peaks or outgoing processes to unusual services. Permanent prevention minimizes the attack surface: remove unused plugins, keep all components up to date and apply the principle of less privilege in administrative roles.

Finally, communicating to the affected users is key if you detect unauthorised data exfiltration or access, and coordinate with your hosting provider and, where appropriate, with incident response services to contain the intrusion. For monitoring of indicators and technical mitigation, it is appropriate to consult up-to-date technical publications from security and community providers: WordPress Blog It offers applicable analysis and blocking rules, and reports from companies like Sansec provide context for the exfiltration tactics that need to be monitored.