CVE-2026-3300: 
WordPress vulnerability analysis and mitigation

CVE-2026-3300 is a critical Remote Code Execution (RCE) vulnerability via PHP Code Injection in the Everest Forms Pro plugin for WordPress, affecting all versions up to and including 1.9.12. The flaw was disclosed on March 31, 2026, with the GitHub Advisory (GHSA-jfqc-5rvh-wp99) published the same day. It carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its unauthenticated, network-exploitable nature with no user interaction required. The vulnerability was assigned by Wordfence and is actively being exploited in the wild as of June 2026 (GitHub Advisory, Wordfence).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection). The Calculation Addon's process_filter() function in class-evf-form-task.php (line 584) concatenates user-supplied form field values directly into a PHP code string that is subsequently passed to PHP's eval() function without adequate sanitization. While sanitize_text_field() is applied to inputs, it does not escape single quotes or other PHP code-context characters, leaving the eval() call fully injectable. Any string-type form field — including text, email, URL, select, and radio inputs — on a form using the "Complex Calculation" feature is a viable injection point. A public PoC repository has been identified at https://github.com/HORKimhab/CVE-2026-3300, and a Nuclei template pull request was submitted to ProjectDiscovery (GitHub Advisory, Wordfence).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary PHP code on the web server with the privileges of the web server process. This enables full site compromise, including creation of rogue administrator accounts, installation of web shells or malware, data exfiltration, website defacement, and use of the server as a pivot point for further attacks. Wordfence reported blocking over 29,300 attacks targeting this vulnerability, underscoring the breadth of active exploitation (Wordfence, BleepingComputer, Security Affairs).

Active in-the-wild exploitation has been confirmed and widely reported, with Wordfence blocking tens of thousands of attack attempts. A public PoC repository (github.com/HORKimhab/CVE-2026-3300) exists, and a Nuclei detection template has been submitted. The EPSS score is approximately 0.287–0.327%, though real-world exploitation activity suggests the practical risk is significantly higher. No specific threat actor attribution has been published. The vulnerability is not yet listed in the CISA KEV catalog based on available data, but exploitation was reported months after the patch was released in March 2026 (Wordfence, BleepingComputer, DeafNews).

1. Reconnaissance: Use Shodan, Censys, or Google dorks to identify WordPress sites running Everest Forms Pro ≤ 1.9.12 with publicly accessible forms that use the "Complex Calculation" feature.
2. Identify target form: Browse the target WordPress site to locate a form that uses the Calculation Addon's Complex Calculation feature — any form with text, email, URL, select, or radio fields is potentially vulnerable.
3. Craft malicious payload: Prepare a PHP code injection payload that breaks out of the string context using single quotes (e.g., '; system('id'); //) to be injected into a form field value that will be concatenated into the eval() call by process_filter().
4. Submit crafted form: Submit the form with the malicious payload in any string-type field. No authentication is required. The server-side process_filter() function concatenates the input into a PHP string and passes it to eval(), executing the injected code.
5. Achieve code execution: The injected PHP executes on the server as the web server user, enabling the attacker to run system commands, create a web shell, add a rogue WordPress administrator account, or exfiltrate data.
6. Establish persistence: Deploy a PHP web shell to the WordPress uploads or themes directory, or create a new admin user via wp_create_user() injected through the payload, enabling persistent access (GitHub Advisory, Wordfence).

• Network: Unusual POST requests to WordPress form submission endpoints (e.g., wp-admin/admin-ajax.php or form action URLs) containing PHP code patterns such as eval(, system(, base64_decode(, passthru(, or single-quote injection sequences in form field parameters.
• File System: Unexpected PHP files in wp-content/uploads/, wp-content/themes/, or wp-content/plugins/ directories with obfuscated content or web shell signatures; newly created PHP files not associated with plugin updates.
• Logs: WordPress access logs showing repeated POST requests to form endpoints with encoded or suspicious payloads; PHP error logs showing eval() execution errors or unexpected function calls originating from class-evf-form-task.php.
• WordPress Database: New administrator accounts created without corresponding legitimate user activity; unexpected changes to wp_options (e.g., siteurl, admin_email) or wp_users tables.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, nginx, php-fpm) such as curl, wget, bash, or python making outbound connections to unknown IPs (Wordfence, BleepingComputer).

The primary remediation is to update the Everest Forms Pro plugin to a version beyond 1.9.12; the patched free plugin code is referenced in the changelog at everestforms.net/changelog. If immediate patching is not possible, disable the Calculation Addon or the Complex Calculation feature on all public-facing forms. Deploying a Web Application Firewall (WAF) — such as Wordfence's firewall — with rules to detect and block PHP code patterns (e.g., eval(, system(, base64_decode() in form submissions provides an interim mitigation layer. Site owners should also audit WordPress administrator accounts for unauthorized additions and scan the file system for newly created PHP files (GitHub Advisory, Wordfence).

Wordfence published a detailed blog post confirming active exploitation and reporting over 29,300 blocked attacks, which served as the primary authoritative source for the security community (Wordfence). BleepingComputer, The Hacker News, Security Affairs, SecurityWeek, Infosecurity Magazine, and TechRadar all covered the active exploitation wave, amplifying awareness (BleepingComputer, The Hacker News, SecurityWeek). Social media discussion was significant across Mastodon (infosec.exchange), Reddit (r/SecOpsDaily, r/Wordpress, r/pwnhub), Bluesky, LinkedIn, and Telegram, with researchers highlighting the irony of a patch being available since March while mass exploitation only began in June 2026. Check Point also published a defense advisory (cpai-2026-6154), and Qualys added detection in their April 2026 application security update.