---
title: Hackers Exploiting Critical WordPress Plugin Flaw in Tens of Thousands of Attacks
description: "Urgent: Everest Forms Pro WordPress plugin flaw under attack. Update to patch 1.9.13 to prevent unauthorized admin access."
canonical_url: https://codekeeper.co/ticker/everest-forms-pro-plugin-vulnerability-exploit
---

# Hackers Exploiting Critical WordPress Plugin Flaw in Tens of Thousands of Attacks

Urgent: Everest Forms Pro WordPress plugin flaw under attack. Update to patch 1.9.13 to prevent unauthorized admin access.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jun 5, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Feverest-forms-pro-plugin-vulnerability-exploit%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Feverest-forms-pro-plugin-vulnerability-exploit%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Feverest-forms-pro-plugin-vulnerability-exploit%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Feverest-forms-pro-plugin-vulnerability-exploit%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Feverest-forms-pro-plugin-vulnerability-exploit%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Feverest-forms-pro-plugin-vulnerability-exploit%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A critical vulnerability in the Everest Forms Pro WordPress plugin is under active attack, with Wordfence blocking over 29,300 exploitation attempts since April 13, 2026 — 17,900 of them on a single day, May 16. The flaw, CVE-2026-3300, scores a near-perfect 9.8 on the CVSS scale and affects all versions up to 1.9.12. The bug lives in the plugin's "Complex Calculation" feature, where user inputs are concatenated into PHP code and passed to eval() without the single quotes being escaped. Attackers don't need credentials — they just submit a crafted form field. Sites that don't use Complex Calculation aren't exposed. Most attacks aim to create rogue admin accounts via WordPress's own wp_insert_user() function, with one common payload creating a user named "diksimarina" — the foothold for uploading webshells and planting backdoors. A patch (version 1.9.13) has been available since March 18. Update immediately. **Source:** [Cybersecurity News](https://cybersecuritynews.com/wordpress-plugin-vulnerability-exploit/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Feverest-forms-pro-plugin-vulnerability-exploit%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Feverest-forms-pro-plugin-vulnerability-exploit%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Feverest-forms-pro-plugin-vulnerability-exploit%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Feverest-forms-pro-plugin-vulnerability-exploit%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Feverest-forms-pro-plugin-vulnerability-exploit%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Feverest-forms-pro-plugin-vulnerability-exploit%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Vulnerabilities Critical isolated-vm Flaw Lets Untrusted JavaScript Escape Sandbox Aug 24, 2026](https://codekeeper.co/ticker/node-js-sandbox-escape-vulnerability)

[Data breaches 153M Driver's Licenses for Sale, and the Trail Leads to One Vendor Sep 7, 2026](https://codekeeper.co/ticker/153m-drivers-licenses-dark-web-breach)

[Data breaches Pentagon Data Breach Exposes Personal Info of 3 Million People Sep 30, 2026](https://codekeeper.co/ticker/us-defense-data-breach-exposes-3-million-records)

[Cyberattacks Hacker Group Claims Breach of Trump Mobile Customer Data Oct 6, 2026](https://codekeeper.co/ticker/ransomware-breach-trump-mobile-data-exposed)