- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,308
One symbol in the application was enough for someone else's account to receive increased rights.
Even the usual form of feedback can become the initial attack vector if the data handler begins to execute the text sent as a code. Attackers began to actively use the critical vulnerability CVE-2026-3300 (9.8 on the CVSS 3.1 scale, AV:N/AC:L/C/C/H/A:H/A:H/A:H) in Everest Forms Pro for WordPress. The error affects versions 1.9.12 and below and allows you to perform arbitrary code on the server where the site works without logging in.
Everest Forms Pro expands the capabilities of the Everest Forms plugin and helps create forms for applications, registration, payments and other scripts. The problem arose in the function of Complex Calculation, which takes values from the shape fields, inserts them into the PHP code line, and then runs through the eval( function). This function performs the transmitted code, so the error in data processing immediately turns into a dangerous mechanism of attacking WordPress.
The input data went through sanitize_text_field(), but the filter did not shield the single quotes and other symbols that affect the PHP syntax. Because of this, the attacker could close the original line, add its own PHP team and comment on the remnant of the generated code so as not to cause an error.
According to Wordfence, the vulnerability is already used in real attacks to create extraneous admins’ accounts. In one of the recorded scenarios, the attackers transmitted through a text field a value that ran wp_insert_user() and created an administrator with the name diksimarina.
Administrator access gives full control over the hacked site. Through such an account, you can change the contents of pages, install plugins and topics, add hidden entry points and web shells, and access closed databases.
The vulnerability was discovered by the researcher under the nickname h0xilo. Developer Everest Forms released a fix on March 18, but attacks, according to Wordfence, began on April 13. During the observations, Wordfence recorded more than 29 300 attempts to operate.
Site administrators are advised to update Everest Forms Pro to the corrected version, check the logs and the list of administrators for suspicious activity, especially for the presence of a line of diksimmarina. Wordfence also advises to block IP addresses 202.56.2[.]126 and 209.146.60.26, which were most often involved in the attempted operation.
Even the usual form of feedback can become the initial attack vector if the data handler begins to execute the text sent as a code. Attackers began to actively use the critical vulnerability CVE-2026-3300 (9.8 on the CVSS 3.1 scale, AV:N/AC:L/C/C/H/A:H/A:H/A:H) in Everest Forms Pro for WordPress. The error affects versions 1.9.12 and below and allows you to perform arbitrary code on the server where the site works without logging in.
Everest Forms Pro expands the capabilities of the Everest Forms plugin and helps create forms for applications, registration, payments and other scripts. The problem arose in the function of Complex Calculation, which takes values from the shape fields, inserts them into the PHP code line, and then runs through the eval( function). This function performs the transmitted code, so the error in data processing immediately turns into a dangerous mechanism of attacking WordPress.
The input data went through sanitize_text_field(), but the filter did not shield the single quotes and other symbols that affect the PHP syntax. Because of this, the attacker could close the original line, add its own PHP team and comment on the remnant of the generated code so as not to cause an error.
According to Wordfence, the vulnerability is already used in real attacks to create extraneous admins’ accounts. In one of the recorded scenarios, the attackers transmitted through a text field a value that ran wp_insert_user() and created an administrator with the name diksimarina.
Administrator access gives full control over the hacked site. Through such an account, you can change the contents of pages, install plugins and topics, add hidden entry points and web shells, and access closed databases.
The vulnerability was discovered by the researcher under the nickname h0xilo. Developer Everest Forms released a fix on March 18, but attacks, according to Wordfence, began on April 13. During the observations, Wordfence recorded more than 29 300 attempts to operate.
Site administrators are advised to update Everest Forms Pro to the corrected version, check the logs and the list of administrators for suspicious activity, especially for the presence of a line of diksimmarina. Wordfence also advises to block IP addresses 202.56.2[.]126 and 209.146.60.26, which were most often involved in the attempted operation.
