All Topics

Technology

Art

Critical Everest Forms Pro Vulnerability Allows Remote Code Execution on WordPress Sites

12d ago· 1 min readenNews

Summary

A critical vulnerability (CVE-2026-3300, CVSS 9.8) in the Everest Forms Pro plugin, installed on over 100,000 WordPress sites, allows unauthenticated remote attackers to inject and execute malicious PHP code on servers. The flaw resides in the Complex Calculation feature, where insufficient sanitization and failure to escape special characters like single quotes enable attackers to concatenate malicious PHP code into executable strings. This poses a severe security risk to affected WordPress sites.

Source

bskyCritical Everest Forms Pro Vulnerability Allows Remote Code Execution on WordPress Sitesbriefly.co

Key quotes

· 3 pulled

The vulnerability CVE-2026-3300 has a CVSS score of 9.8 and enables unauthenticated remote attackers to inject PHP code through the Complex Calculation feature.

Sanitization does not prevent exploitation because a vulnerable function fails to escape single quotes and other characters and concatenates attacker-supplied values into a PHP code string.

Attackers can include a single quote, malicious PHP, and a comment character to achieve server-side code execution.

Snippet from the RSS feed

Unauthenticated attackers can exploit CVE-2026-3300 in Everest Forms Pro to inject and execute arbitrary PHP via Complex Calculation, enabling site takeover.

You might also wanna read

Supply Chain Attack Compromises Official GravityForms Plugin Repository

A supply chain attack compromised the official GravityForms plugin repository, injecting backdoors into legitimate plugin downloads. The bre

patchstack.com·11mo ago

Analysis of CVE-2026-4020: Coordinated Google Cloud Fleet Exploiting Gravity SMTP WordPress Vulnerability

A detailed technical analysis of CVE-2026-4020, a critical vulnerability in the Gravity SMTP WordPress plugin that exposed sensitive credent

honeylabs.net·3d ago

Critical Authentication Bypass Vulnerability Discovered in cPanel & WHM (CVE-2026-41940)

watchTowr Labs reports on a critical authentication bypass vulnerability (CVE-2026-41940) in cPanel & WHM, a widely-used web hosting control

watchTowr Labs·1mo ago

Critical RCE vulnerability CVE-2026-3854 discovered in GitHub's internal git infrastructure

Wiz Research discovered a critical vulnerability (CVE-2026-3854) in GitHub's internal git infrastructure affecting both GitHub.com and GitHu

Wiz.io·1mo ago

Critical GitHub Copilot Vulnerability Allowed Source Code and Secret Exfiltration

A critical vulnerability (CVSS 9.6) was discovered in GitHub Copilot Chat in June 2025 that allowed attackers to silently exfiltrate secrets

legitsecurity.com·8mo ago

GitHub Copilot Vulnerability Enables Remote Code Execution via Prompt Injection

A critical security vulnerability (CVE-2025-53773) in GitHub Copilot allows attackers to achieve remote code execution by placing the AI ass

embracethered.com·8mo ago