Unauthenticated PHP Code Injection RCE in Everest Forms Pro Complex Calculation

Repository is a small standalone Python exploit project for CVE-2026-3300 targeting WordPress Everest Forms Pro <= 1.9.12. Structure is minimal: one executable Python script (cve-2026-3300.py), a README with usage examples, requirements.txt listing requests, and targets.txt containing sample URLs. The script is the clear entry point and implements four main modes: scan, poc, exploit, and reverse. Core capability: the exploit crafts unauthenticated POST requests containing a malicious value in an Everest Forms field parameter to trigger PHP code injection in the vulnerable calculation functionality. The payload generator supports multiple PHP execution primitives (system, exec, passthru, shell_exec) and appends a PWNED marker to help confirm successful execution. The exploit posts either to /wp-admin/admin-ajax.php with action=everest_forms_process_submission or to the site root / as a fallback. Success is inferred from HTTP 200 responses containing PWNED or common command-output indicators such as uid=, root:, www-data, or command not found. Reconnaissance capability: scan() performs lightweight detection by requesting /wp-json/everest-forms/v1/forms and /wp-admin/admin-ajax.php, looking for strings like everest or evf in responses. This is not a pure detector-only repository; it contains active exploitation logic. Post-exploitation capability: reverse mode builds a bash reverse-shell command using the local host IP and a chosen listener port, starts a threaded TCP listener bound to 0.0.0.0, and then reuses the exploit path to execute the reverse-shell command on the target. Batch operation is supported through targets.txt and ThreadPoolExecutor-based concurrency. Overall, this is an operational standalone web exploit/command-execution tool rather than a framework module. It is not heavily weaponized, but it does provide practical exploitation features beyond a simple proof of concept, including target scanning, configurable payload functions, multithreaded batch exploitation, and a basic interactive reverse-shell workflow.