Active Exploitation of Everest Forms Pro RCE Creates Rogue WordPress Admins

Attackers are actively exploiting CVE-2026-3300, a critical unauthenticated remote code execution flaw in the Everest Forms Pro WordPress plugin, to fully compromise vulnerable sites. The bug affects versions through 1.9.12 and was fixed in 1.9.13. It stems from the plugin’s Complex Calculation feature, where user-controlled input in process_filter() is concatenated into PHP code and executed with eval(), allowing arbitrary PHP injection through crafted form submissions, often via the /wp-admin/admin-ajax.php endpoint.

Wordfence reported exploitation beginning on April 13 and escalating into mass attacks, with more than 29,300 exploit attempts blocked overall and over 17,900 on May 16 alone. A recurring payload creates a rogue administrator account named diksimarina, giving attackers persistent access to upload webshells, install backdoors, alter site content, and potentially pivot deeper into the hosting environment. Defenders are being urged to upgrade immediately to 1.9.13 or later, audit WordPress administrator accounts for unauthorized users, and review logs for suspicious requests and known malicious IP activity.