{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-3300/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-3300"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-ADAMSHAIKHMA-CVE-2026-3300\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["wordpress","rce","php-injection","cve-2026-3300"],"_cs_type":"advisory","_cs_vendors":["Everest Forms"],"content_html":"\u003cp\u003eThe Everest Forms Pro plugin, a popular WordPress form builder, contains a critical vulnerability (CVE-2026-3300) leading to Remote Code Execution (RCE). Present in versions up to and including 1.9.12, the vulnerability stems from inadequate input sanitization within the Calculation Addon's \u003ccode\u003eprocess_filter()\u003c/code\u003e function. Specifically, user-submitted form field values are directly concatenated into a PHP code string without proper escaping, which is then processed by the \u003ccode\u003eeval()\u003c/code\u003e function. The \u003ccode\u003esanitize_text_field()\u003c/code\u003e function does not adequately neutralize single quotes or other characters crucial for preventing code injection. Successful exploitation grants unauthenticated attackers the ability to execute arbitrary PHP code on the server hosting the WordPress instance. This can lead to complete system compromise, data theft, and website defacement.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies a WordPress website using a vulnerable version of the Everest Forms Pro plugin (\u0026lt;= 1.9.12) with the 'Complex Calculation' feature enabled on a form.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious payload containing PHP code designed to execute system commands. This payload leverages PHP's \u003ccode\u003eeval()\u003c/code\u003e function and injects code using single quotes and other PHP context characters.\u003c/li\u003e\n\u003cli\u003eThe crafted payload is submitted via a string-type form field (e.g., text, email, URL) within the vulnerable form.\u003c/li\u003e\n\u003cli\u003eThe Everest Forms Pro plugin's \u003ccode\u003eprocess_filter()\u003c/code\u003e function processes the submitted data. The \u003ccode\u003esanitize_text_field()\u003c/code\u003e function fails to properly escape the malicious payload.\u003c/li\u003e\n\u003cli\u003eThe malicious payload is concatenated into a PHP code string and passed to the \u003ccode\u003eeval()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eeval()\u003c/code\u003e function executes the injected PHP code, allowing the attacker to execute arbitrary commands on the server.\u003c/li\u003e\n\u003cli\u003eThe attacker can then perform actions such as reading sensitive files, installing backdoors, or modifying website content.\u003c/li\u003e\n\u003cli\u003eThe attacker gains persistent access to the web server, enabling further malicious activities and potentially compromising the entire system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability (CVE-2026-3300) can lead to complete compromise of the WordPress website and the underlying server. Attackers can gain unauthorized access to sensitive data, including user credentials and financial information. They can deface websites, inject malware, and use the compromised server as a launchpad for further attacks. Given the widespread use of Everest Forms Pro, a large number of WordPress websites are potentially vulnerable, with the exact number of victims depending on the adoption rate of the affected versions. A successful RCE can result in significant financial losses, reputational damage, and legal liabilities.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Everest Forms Pro plugin to the latest version (greater than 1.9.12) to patch CVE-2026-3300.\u003c/li\u003e\n\u003cli\u003eImplement the Sigma rule \u003ccode\u003eDetect Everest Forms Pro PHP Injection\u003c/code\u003e to identify potential exploitation attempts in web server logs.\u003c/li\u003e\n\u003cli\u003eReview WordPress web server logs for suspicious POST requests to \u003ccode\u003e/wp-admin/admin-ajax.php\u003c/code\u003e containing PHP code in form field values, and investigate any identified anomalies.\u003c/li\u003e\n\u003cli\u003eApply input validation and output encoding to all user-supplied data within WordPress plugins to prevent code injection vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-13T09:13:25Z","date_published":"2024-01-26T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-everest-forms-rce/","summary":"The Everest Forms Pro plugin for WordPress is vulnerable to remote code execution (RCE) due to a PHP Code Injection vulnerability (CVE-2026-3300) allowing unauthenticated attackers to execute arbitrary PHP code by exploiting insufficient input sanitization in the 'Complex Calculation' feature, affecting versions up to 1.9.12.","title":"Everest Forms Pro Plugin Remote Code Execution via PHP Injection","url":"https://feed.craftedsignal.io/briefs/2024-01-everest-forms-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-3300","version":"https://jsonfeed.org/version/1.1"}