Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites
A critical vulnerability (CVE-2026-3300) in the Everest Forms Pro WordPress plugin has been exploited by threat actors, allowing for remote code execution and potential site compromise. Attackers have been actively targeting sites using the plugin since April 13, 2026, attempting to create administrator accounts and establish persistent footholds. The vulnerability stems from a lack of proper input sanitization within the plugin’s calculation addon, enabling attackers to inject and execute PHP code.
The vulnerability, a 9.8 CVSS score, resides within the `process_filter()` function of the Everest Forms Pro plugin’s Calculation Addon. The issue arises from the failure to adequately escape user-submitted form field values before passing them to the `eval()` function, leading to the ability for unauthenticated attackers to inject and execute arbitrary PHP code. This allows for actions such as creating rogue administrator accounts, deploying web shells, and gaining deeper access to the server. As of April 13, 2026, over 29,300 exploit attempts have been blocked, with 16 attempts detected in the last 24 hours, primarily targeting the creation of an administrator account named "diksimarina" ([email protected]). The attack originates from multiple IP addresses, including 202.56.2.126, 209.146.60.26, and 15.235.166.18. Additionally, the article details a broader skimmer campaign utilizing Stripe as a command-and-control (C2) server and data exfiltration sink, alongside a large-scale operation dubbed GorgonAgora employing thousands of fake storefronts to steal card data. This highlights the use of Google Tag Manager (GTM) and Stripe domains (googletagmanager.com and api.stripe.com) to deliver malicious code and exfiltrate stolen financial information.