What is the CVSS score of CVE-2026-3300?

CVE-2026-3300 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-3300?

Everest Forms Pro plugin for WordPress versions 1.9.12 and earlier contains a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands on…

Is there a public PoC exploit available for CVE-2026-3300?

Yes, a public proof-of-concept exploit is available for CVE-2026-3300. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-3300?

Within 24 hours: Identify all WordPress installations using Everest Forms Pro ≤1.9.12 via plugin inventory audit; disable or deactivate the plugin immediately across all affected systems. Within 7 days: Contact Everest Forms vendor for patch availability status and timeline; evaluate alternative form plugins for migration. Within 30 days: Migrate to patched version (once released) or replace with alternative form solution; conduct forensic analysis of access logs and database for indicators of compromise dating back to plugin deployment.

PHP CVE-2026-3300

EUVD-2026-17275 CRITICAL

Code Injection (CWE-94)

2026-03-31 Wordfence

PHP WordPress RCE Code Injection Everest Forms Pro Wordpress Plugin Wpeverest

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Mar 31, 2026 - 01:45 euvd

EUVD-2026-17275

Analysis Generated

Mar 31, 2026 - 01:45 vuln.today

CVE Published

Mar 31, 2026 - 01:24 nvd

CRITICAL 9.8

DescriptionCVE.org

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the "Complex Calculation" feature.

AnalysisAI

Remote code execution in Everest Forms Pro plugin for WordPress ≤1.9.12 allows unauthenticated attackers to execute arbitrary PHP code on the server via the Complex Calculation feature. Attackers can inject malicious PHP through any string-type form field (text, email, URL, select, radio) due to unsafe concatenation into eval() without proper escaping. This vulnerability carries a 9.8 CVSS score with maximum impact (confidentiality, integrity, availability) and requires no authentication or user interaction, representing a critical immediate threat to all installations using the affected plugin versions.

Technical ContextAI

This vulnerability affects the Everest Forms Pro WordPress plugin (cpe:2.3:a:wpeverest:everest_forms_pro), specifically in the Calculation Addon's process_filter() function. The root cause is a CWE-94 (Improper Control of Generation of Code / Code Injection) flaw where user-submitted form field values are concatenated directly into a PHP code string and passed to the eval() function. While the code applies sanitize_text_field() to user input, this WordPress sanitization function only removes HTML tags and line breaks - it does not escape single quotes, backslashes, or other PHP code metacharacters. When the Complex Calculation feature is enabled on a form, an attacker can submit crafted payloads containing PHP code fragments in any string-type field. These values are then dynamically concatenated into executable PHP strings, bypassing the insufficient sanitization and allowing arbitrary code execution in the context of the web server process. The eval() function subsequently executes this attacker-controlled code with full server-side privileges.

RemediationAI

Immediately upgrade to the latest patched version of Everest Forms Pro. The vendor changelog is available at https://everestforms.net/changelog/ where administrators should identify and deploy the first version released after 1.9.12 that addresses CVE-2026-3300. If immediate patching is not feasible, implement emergency mitigations: disable the Complex Calculation feature in all forms through the plugin settings, or temporarily deactivate the Everest Forms Pro plugin entirely until patching is complete. Review web server logs for suspicious form submissions containing PHP code patterns (such as system(), exec(), passthru(), or other PHP functions in POST data) to identify potential exploitation attempts. After patching, conduct a full security audit of the WordPress installation including file integrity verification, review of recently created admin accounts, and inspection of any unexpected scheduled tasks or modified core files. Consider implementing Web Application Firewall (WAF) rules to block common PHP code injection patterns in form submissions as a defense-in-depth measure. For additional context on the vulnerability and remediation guidance, consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/389c0b89-e408-4ad5-9723-a16b745771f0?source=cve.