Hackers Exploiting Critical WordPress Plugin Flaw in Tens of Thousands of Attacks

Urgent: Everest Forms Pro WordPress plugin flaw under attack. Update to patch 1.9.13 to prevent unauthorized admin access.

By Content Team

Jun 5, 2026

ON THIS PAGE

A critical vulnerability in the Everest Forms Pro WordPress plugin is under active attack, with Wordfence blocking over 29,300 exploitation attempts since April 13, 2026 — 17,900 of them on a single day, May 16. The flaw, CVE-2026-3300, scores a near-perfect 9.8 on the CVSS scale and affects all versions up to 1.9.12.

The bug lives in the plugin's "Complex Calculation" feature, where user inputs are concatenated into PHP code and passed to eval() without the single quotes being escaped. Attackers don't need credentials — they just submit a crafted form field. Sites that don't use Complex Calculation aren't exposed.

Most attacks aim to create rogue admin accounts via WordPress's own wp_insert_user() function, with one common payload creating a user named "diksimarina" — the foothold for uploading webshells and planting backdoors.

A patch (version 1.9.13) has been available since March 18. Update immediately.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?