CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Everest Forms Pro (WordPress) Calculation Addon unauthenticated eval() PHP code injection (CVSS 9.8); mass exploitation since 2026-04-13 creating rogue admin accounts; patched v1.9.13 (2026-03-18)

cve · CVE-2026-3300

Coverage
1
first 2026-06-08 → last 2026-10-11
Latest activity
2026-06-08
Attackers turned an Everest Forms Pro code-injection flaw, patched in March, into rogue admin accounts on…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
3
3 hosts

Defender insights

What each entry about CVE-2026-3300 tells a defender to do, newest first.

2026-06-08NOTABLEexploitedAttackers turned an Everest Forms Pro code-injection flaw, patched in March, into rogue admin accounts on WordPress sites

Exposure · detection

Story timeline

  1. 2026-06-08CVE-2026-3300: unauthenticated code execution in Everest Forms Pro exploited since April to create rogue WordPress administrators, fixed in March
    trending-vulnerabilitiesAttackers turned an Everest Forms Pro code-injection flaw, patched in March, into rogue admin accounts on WordPress sites

Hunting pivots

Affected products
Everest Forms Pro
Tags
actively-exploitedpre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • PersistenceCreate Account: Local Account

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-06-08/cve-2026-3300-unauthenticated-eval-injection-in-a-commercial · ATT&CK page ↗

Persistence TA0003

T1136.001Create Account: Local Account×1

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Evidence: 2026-06-08/cve-2026-3300-unauthenticated-eval-injection-in-a-commercial · ATT&CK page ↗

Entries about Everest Forms Pro (WordPress) Calculation Addon unauthenticated eval() PHP code injection (CVSS 9.8); mass exploitation since 2026-04-13 creating rogue admin accounts; patched v1.9.13 (2026-03-18) (1)

2026-06-08 · view entry permalink →

NOTABLECVE-2026-3300exploitedupdatedNATOB2

CVE-2026-3300: unauthenticated code execution in Everest Forms Pro exploited since April to create rogue WordPress administrators, fixed in March

CVE-2026-3300 (CVSS 9.8) is an unauthenticated remote code execution flaw in Everest Forms Pro, a commercial WordPress plugin with about 4,000 active installations, which Wordfence disclosed on 2026-03-30 after the vendor shipped the fix on 2026-03-18 (Wordfence, 2026-06-03). Attacker input reaches PHP evaluation through the plugin's calculation feature; the most common payload Wordfence sees closes a string literal and calls wp_insert_user() to create an administrator account (Wordfence, 2026-06-03). Attacks began on 2026-04-13 and peaked on 2026-05-16, when Wordfence blocked more than 17,900 attempts (Wordfence, 2026-06-03); The Hacker News and BleepingComputer reported the campaign in early June (The Hacker News, 2026-06-05) (BleepingComputer, 2026-06-06).

attackers started actively targeting this vulnerability on April 13th, 2026, with mass exploitation occurring on May 16th, 2026

Wordfence 2026-06-03
Correctionrun 2026-10-11T1307Z-audittitleheadlinesummarysectorstechniquesaffected_productscvessourcesevidenceclassificationactionsdeep_divedeep_dive_categorybodyevent_datesourcing_note

Wordfence published its exploitation report on 2026-06-03 and dates the peak to 2026-05-16, with more than 17,900 attempts blocked that day (Wordfence, 2026-06-03). The plugin has about 4,000 active installations, and no source names public-sector victims.

vulnerability08 Jun 05:00Zmulti-sourceOpen finding →
Sources: Wordfence · BleepingComputer · The Hacker News

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bleepingcomputer.com1 (33%)
  • thehackernews.com1 (33%)
  • wordfence.com1 (33%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)