Everest Forms Pro RCE Under Active Exploitation on WordPress Sites

Attackers are exploiting a critical remote code execution flaw in Everest Forms Pro, the premium WordPress form-builder plugin, to seize full control of vulnerable sites.

The bug is tracked as CVE-2026-3300 and carries a CVSS score of 9.8. It affects every version of the plugin up to and including 1.9.12. The vendor has shipped a patched build, but exploitation is already underway.

Everest Forms Pro has roughly 4,000 active installations. That's a small footprint by WordPress standards. It's also a population skewed toward small businesses running contact forms, lead-capture, and payment workflows — exactly the sites where a quiet webshell pays off.

What the flaw does

The vulnerability allows unauthenticated remote code execution. In practice, that means an attacker can run arbitrary PHP on the host without credentials, drop a backdoor, pivot into the database, and harvest whatever the form plugin has been collecting.

What the form plugin has been collecting is the problem.

Forms built with Everest commonly handle names, email addresses, phone numbers, postal addresses, uploaded ID documents, and in Pro deployments, payment metadata routed through Stripe or PayPal integrations. None of that lives in the plugin long-term, but submissions are typically stored in the WordPress database and in email logs. A site takeover exposes the lot.

Jurisdiction and notification exposure

Operators of compromised sites should assume a personal data breach has occurred and triage accordingly. In the EU and UK, that's a 72-hour clock under GDPR Article 33 to notify the relevant supervisory authority (the ICO, CNIL, and so on). In Australia, the OAIC's Notifiable Data Breaches scheme applies where serious harm is likely. US operators face a patchwork of state AG notification rules, plus the FTC if misrepresentations about security were made to consumers.

"Sophisticated" this is not. It's an unauthenticated RCE in a plugin, and the patch was available before mass exploitation began.

What affected site owners should do

• Update Everest Forms Pro to the patched release immediately. If you can't patch, deactivate and delete the plugin until you can.
• Assume compromise on any site that ran 1.9.12 or earlier while exposed. Rotate all WordPress admin passwords, API keys, SMTP credentials, and any payment-processor keys stored in wp-config.php or plugin settings.
• Hunt for unexpected PHP files in wp-content/uploads/, modified .htaccess rules, and new admin users created since the plugin went public-facing.
• Pull a copy of the form-submissions table and email logs to determine the categories and volume of personal data potentially accessed. That dataset drives your notification obligations.
• If submissions included payment or government ID data, engage counsel before the 72-hour GDPR window closes.

A forensic image taken now is cheaper than reconstructing the timeline from server logs in three weeks.