Remote Code Execution in Everest Forms

If you’re running Everest Forms with the Calculation Addon enabled, you need to update right now. CVE-2026-3300 is a critical remote code execution vulnerability affecting all versions up to 1.9.12, and it’s being actively exploited.

What’s the vulnerability?

The Calculation Addon lets form builders create complex mathematical calculations based on user-submitted values. Sounds useful, right? The problem is that the plugin concatenates user input directly into a PHP expression and passes it to eval().

That’s the vulnerability in a nutshell. User input becomes executable PHP code.

Here’s the dangerous pattern:

$field_value = $_POST['form_field']; // User-controlled
$expression = "calculate(" . $field_value . ")";
eval($expression); // Executes whatever the user submitted

An attacker can break out of the intended expression context and run arbitrary PHP. No authentication required — any visitor can submit a form.

How bad is it?

CVSS 9.8 Critical. An unauthenticated attacker can execute arbitrary PHP code on your server. That means:

• Creating rogue admin accounts
• Stealing customer data and payment information
• Installing backdoors and web shells
• Modifying your site’s content
• Using your server to attack other sites

This isn’t theoretical. Security researchers have observed 29,300+ blocked exploitation attempts since 2026-04-13. The attackers are using automated scanning to find vulnerable Everest Forms installations and attempting to create persistent admin accounts named diksimarina.

Who’s affected?

• Everest Forms versions: ≤1.9.12
• Calculation Addon: Required (Pro feature)
• Authentication: Not required — any form visitor can exploit this
• Installs: 100,000+ (free version), 4,000+ (Pro version)

If you’re running Everest Forms with the Calculation Addon, you’re vulnerable.

What to do

Step 1: Update immediately

Upgrade to Everest Forms 1.9.13 or later. This is not optional.

# Via WordPress admin
Dashboard → Plugins → Everest Forms → Update

Step 2: Check for compromise

After updating, check whether your site was already compromised:

1. Look for rogue admin accounts:
   • Go to Dashboard → Users
   • Look for unfamiliar accounts, especially diksimarina
   • Delete any accounts you don’t recognise
2. Review your logs:
   • Check your web server access logs for suspicious form submissions
   • Look for POST requests to your Everest Forms pages with unusual payloads
   • Check /wp-content/uploads/ for new PHP files
3. Scan for backdoors:
   • Use a WordPress security plugin (Wordfence, Sucuri) to scan for malware
   • Check theme and plugin files for unexpected modifications
   • Look for new scheduled tasks or cron jobs

Step 3: Rotate credentials

If you suspect compromise:

• Change all WordPress user passwords
• Rotate FTP/SFTP credentials
• Reset your database password
• Update API keys and tokens

Step 4: Restore from backup

If you find evidence of compromise, restore your site from a clean backup taken before the attack date. Don’t just delete the rogue account — attackers often leave multiple backdoors.

Why sanitisation doesn’t help

Some developers think sanitising the input would fix this. It doesn’t:

// STILL VULNERABLE
$field_value = sanitize_text_field( $_POST['form_field'] );
$expression = "calculate(" . $field_value . ")";
eval($expression); // Still dangerous!

Sanitisation removes HTML and script tags, but it can’t prevent PHP code injection. An attacker can craft payloads that break out of the intended expression context.

The only safe approach is to never use eval() with user input. Period.

What’s the fix?

The Everest Forms team patched this in version 1.9.13 by removing the dangerous eval() call and using a proper expression parser instead. This is the right way to handle user-submitted calculations.

If you don’t use the Calculation Addon

If you’re running Everest Forms but you’re not using the Calculation Addon, you’re not vulnerable to this specific CVE. However, you should still update to the latest version for other security improvements and bug fixes.

The bigger picture

This vulnerability is a reminder that eval() and user input don’t mix. Ever. No amount of sanitisation can make it safe. If you’re building forms or plugins that need to evaluate user-submitted expressions, use a dedicated library like symfony/expression-language instead of rolling your own.

Update your Everest Forms installation now. Check for compromise. Rotate your credentials. And if you find evidence of an attack, restore from backup.

Don’t wait on this one.