Critical WordPress Plugin Vulnerability Leads to Website Takeovers

Attackers are exploiting CVE-2026-3300, a critical remote code execution vulnerability in the Everest Forms Pro WordPress plugin, to gain complete control of websites. The flaw exists in the plugin's Calculation Addon where user input is improperly escaped before being passed to PHP's eval() function, allowing arbitrary code execution. With over 29,300 exploitation attempts blocked and attackers creating admin accounts for persistent access, this demonstrates how third-party plugin vulnerabilities can completely compromise website security. Organizations must prioritize rapid patching of critical vulnerabilities and implement proper input validation to prevent code injection attacks.

Tactical Insight

Immediate actions

Update Everest Forms Pro plugin to version 1.9.13 or later immediately
Audit all administrator accounts and remove any suspicious accounts like 'diksimarina'
Enable WordPress security plugins with real-time malware scanning

Long-term improvements

Implement automated vulnerability scanning for all WordPress plugins and themes
Establish a plugin inventory management system with regular security assessments
Configure automatic security updates for non-critical plugins where possible

Detection measures

Monitor WordPress access logs for unusual admin account creation activities
Set up alerts for unexpected PHP code execution or eval() function usage
Implement file integrity monitoring to detect unauthorized changes to WordPress core files