CVE-2026-3300 - Vulnerability Analysis

Overview

Everest Forms Pro plugin for WordPress <= 1.9.12 contains a remote code execution caused by improper escaping of user-submitted form field values in the Calculation Addon's process_filter() function, letting unauthenticated attackers execute arbitrary PHP code via crafted input in string-type form fields when using the Complex Calculation feature.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary PHP code on the server, potentially leading to full system compromise.

Mitigation

Update to the latest version of Everest Forms Pro plugin.

References

• https://www.wordfence.com/threat-intel/vulnerabilities/id/389c0b89-e408-4ad5-9723-a16b745771f0?source=cve
• https://everestforms.net/changelog/
• https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/class-evf-form-task.php#L584

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner