CTI Daily Brief — 2026-06-08

• Everest Forms Pro (WordPress) CVE-2026-3300 — unauthenticated eval() injection under mass exploitation. A pre-auth PHP code-injection in the plugin's Calculation Addon lets attackers create rogue administrator accounts; Wordfence has blocked 29,300+ attempts since 13 April despite a fix shipping 18 March (Wordfence, 2026-06-06). Patch lag, not the bug, is the story — full technical analysis in § 5.
• Acer Wave-7 mesh routers — two CVSS 10.0 zero-days, no patch until end-June. An unauthenticated cleartext-credential log (CVE-2026-49200) plus a hardcoded AES key in the backup handler (CVE-2026-49201) chain to full unauth takeover with persistence; Acer's only guidance is interim mitigation (BleepingComputer, 2026-06-03).
• FIFA World Cup 2026 threat cluster ahead of the 11 June kick-off. Beyond the previously-flagged phishing-domain layer, ThreatFabric documents Android banking trojans (Massiv, Perseus) bound into counterfeit streaming apps with full device-takeover and SMS/push MFA interception (ThreatFabric, 2026-06-04) — a direct risk to travelling staff and BYOD fleets.
• ICO uses criminal asset-recovery against insider data theft. The UK regulator secured £118,852 in Proceeds-of-Crime confiscation orders from two former RAC employees who sold ~30,000 customer records — a reminder that insider exfiltration of even modest volumes attracts prosecution and clawback years later (POCA orders, Nov 2025 + 29 May 2026; ICO).

No qualifying updates in window — section intentionally left empty. The day's candidate "updates" (Cisco Catalyst SD-WAN Manager CVE-2026-20245, SolarWinds Serv-U CVE-2026-28318, and the Luna Moth / Silent Ransom Group fast-flux and physical-intrusion tradecraft) were each covered in the 2026-06-06 brief — including the 6 June deep dive on Silent Ransom Group — and carry no material development since. They are listed in § 7 to record that they were re-checked.

Why this is the deep dive now. CVE-2026-3300 is a textbook web-app RCE that matters less for its novelty than for what it shows about patch lag in the commercial-plugin supply chain: the vendor fixed it on 18 March 2026, yet Wordfence has logged sustained mass exploitation from 13 April through at least 6 June, with a single-day peak of 17,900 blocked attempts on 16 May (Wordfence, 2026-06-06). WordPress underpins a large share of cantonal, municipal and agency web estates, so any public-sector site still running Everest Forms Pro ≤ 1.9.12 is exposed to a fully unauthenticated site takeover today — the patch existing for three months does not help a site that never applied it.

The bug. The vulnerability lives in the process_filter() function of the plugin's Calculation Addon, which builds a PHP expression string from user-submitted form-field values and evaluates it with eval() (BleepingComputer, 2026-06-06). The only input handling applied is sanitize_text_field(), which strips tags and normalises whitespace but does not escape single quotes or PHP syntax metacharacters. An unauthenticated attacker who submits a form containing a calculation field can therefore inject a single quote to terminate the intended string literal, append arbitrary PHP, and comment out the trailing remainder of the generated expression with //. Because the sink is eval(), this is direct code execution in the WordPress PHP context — no file write, no upload, no authentication. The CVE prerequisite is narrow but common: the form must include the Calculation Addon. Affected versions are ≤ 1.9.12; fixed in 1.9.13. The flaw was credited to researcher h0xilo (BleepingComputer, 2026-06-06).

Observed exploitation chain. The dominant in-the-wild payload uses the code-execution primitive to call WordPress's own wp_insert_user() and create a rogue account with the administrator role — converting a single unauthenticated POST into persistent privileged access to the site, from which attackers typically install webshells, SEO-spam injectors or redirect malware. Mapped to MITRE ATT&CK: initial access via T1190 Exploit Public-Facing Application; execution of injected PHP via T1059 Command and Scripting Interpreter; persistence by T1136 Create Account, after which the attacker operates with T1078 Valid Accounts.

Detection concepts (no IOCs). The highest-fidelity signal is unexpected administrator-account creation: hunt WordPress user_register events that assign the administrator role, and reconcile the live admin-user list against a known-good baseline — any account you cannot attribute to a person or process is suspect. At the request layer, alert on POSTs to the form-handling endpoints (admin-ajax.php and the plugin's AJAX actions) whose parameters contain PHP-syntax artefacts such as stray single quotes followed by function-call tokens or trailing // comment markers. Post-exploitation, watch for new or modified PHP files in wp-content/ and for outbound requests from the web host that correlate with webshell or SEO-spam behaviour. These are behavioural concepts, not signatures — tune to your own form traffic.

Hardening. Update Everest Forms Pro to 1.9.13 or later immediately; if you cannot patch on the spot, disable the Calculation Addon (the vulnerable code path) or take affected forms offline, and audit for already-created rogue admin accounts before re-enabling. A WAF rule blocking PHP-metacharacter patterns in form-submission parameters is a reasonable compensating control, but it is mitigation, not a fix. More broadly, this CVE is an argument for maintaining an inventory of commercial plugins and their versions across your WordPress estate and wiring plugin-update monitoring into change management — the recurring failure mode here is not the vulnerability class but the months-long gap between a vendor fix and its deployment.

• Patch Everest Forms Pro to 1.9.13+ today if you run it (see § 5). Unauthenticated, actively exploited at scale. If you cannot patch immediately, disable the Calculation Addon and audit the WordPress admin-user list for rogue accounts created since mid-April before re-enabling.
• Apply Acer's interim mitigations on any Wave-7 mesh routers (see § 2 CVE-2026-49200/49201) — no patch exists until end-June. Disable remote administration, restrict the management interface to trusted internal segments, and rotate credentials given the cleartext-log exposure.
• Stand up FIFA-period mobile and DNS controls (see § 1). Enforce no-sideloading / Play-Store-only and block Accessibility-service grants via MDM, prefer phishing-resistant MFA for high-value accounts during the tournament window, and load FIFA-themed domain blocklists into DNS filtering.
• Review insider-data-theft controls on contact-centre / CRM data (see § 1 ICO). Scope access need-to-know, monitor privileged-user bulk-export and anomalous query patterns, and retain audit trails long enough to support prosecution.
• Reduce edge UPnP exposure and hunt SOHO/branch gateways (see § 3). Restrict inbound SSDP / outbound UDP 1900 and disable UPnP where unused; on Linux gateways hunt cron entries spawning processes from hidden dot-directories.