What is CVE-2026-3300?
The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the "Complex Calculation" feature.
Timeline
- 2026-03-31Published to the U.S. National Vulnerability Database (NVD)
- 2026-06-06First covered in a defend.network daily briefing
- 2026-06-17NVD record last updated
Affected product
See advisory
Remediation Steps
- Apply the vendor security update for WordPress Everest Forms Pro as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References
Referenced in our briefings & reports
- Vulnerability Priority Report – Week 2 of June 2026 (June 8 – 14)
- Miasma worm hits Microsoft GitHub, SolarWinds Serv-U actively exploited, WordPress Everest Forms RCE (2026-06-08)
- Miasma worm hits Microsoft GitHub; SolarWinds actively exploited; Chrome 429 patches (2026-06-07)
- Critical Exploits: npm Supply Chain, WordPress Plugin, SolarWinds, IIS Attacks (2026-06-06)
Browse all tracked CVEs in the defend.network CVE database →