Security Alert Summary
The Everest Forms Pro plugin for WordPress contains a remote code execution vulnerability (CVE-2026-3300) tied to the Calculation Addon. The addon concatenates user-submitted values into PHP code and passes them to eval() without proper escaping, allowing unauthenticated attackers to inject and execute arbitrary PHP when a form uses the “Complex Calculation” feature.
CVE Details
- CVE ID: CVE-2026-3300
- Affected component: Everest Forms Pro plugin (Calculation Addon)
- Affected versions: all versions up to, and including, 1.9.12
- Published: March 31, 2026 at 2:15:59 AM UTC
- Last modified: March 31, 2026 at 2:15:59 AM UTC
- CVSS v3.1: Base Score 9.8; Severity: CRITICAL; Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Authentication / Privileges / User interaction: Authentication not required; Privileges required: None; User interaction: None
- Attack vector / Complexity: Network / Low
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness (CWE): CWE-94 (Improper Control of Generation of Code)
Technical Details
The vulnerability is a PHP code injection that leads to remote code execution. The Calculation Addon’s process_filter() function builds a PHP code string by concatenating user-submitted form field values and then passes that string to eval() for execution. Although the plugin applies sanitize_text_field() to input, that function does not escape single quotes or other characters that are significant in PHP code contexts. As a result, an attacker can submit a crafted value in any string-type form field (for example: text, email, URL, select, radio) when a form uses the “Complex Calculation” feature and cause arbitrary PHP code to be evaluated on the server.
The description names the specific function and the use of eval() as the root cause: unescaped concatenation of user input into executable PHP code. No additional checks or escaping suitable for embedding untrusted data into PHP code are performed before evaluation.
How This Could Impact Your Website
In a typical scenario, a site owner publishes forms used by internal staff and external contributors. If a form uses the “Complex Calculation” feature, an unauthenticated attacker could submit a crafted value and trigger execution of PHP on the server. Practical consequences include disclosure of sensitive data stored on the site, modification of site content or configuration, or disruption of service.
Specific realistic risks include exposure of internal user email addresses or other data used in form fields, which can increase the likelihood of targeted phishing or social engineering against staff or contractors. The integrity of form submissions and calculation results may be altered, and availability of site components could be affected if the injected code disrupts execution.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior, particularly unexpected PHP execution or changes to files.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
