A critical vulnerability (CVE-2026-3300) in the Everest Forms Pro WordPress plugin, affecting over 100,000 sites, has been exploited for months, allowing attackers to inject and execute arbitrary PHP code remotely. Users are urged to update to version 1.9.13 or newer to protect against unauthorized administrative account creation and other threats.
A critical vulnerability in the Everest Forms Pro WordPress plugin (CVE-2026-3300) has been actively exploited, allowing unauthenticated attackers to inject and execute arbitrary PHP code, leading to potential site takeovers. As someone focused on threat intelligence and incident response, ensure that WordPress deployments are updated to version 1.9.13 or newer immediately, and monitor for unauthorized admin accounts, particularly with the username 'diksimarina'.