Everest Forms Pro RCE Under Active Exploitation on WordPress Sites

Key points

• CVE-2026-3300 is a 9.8-severity remote code execution flaw in Everest Forms Pro, affecting all versions up to and including 1.9.12.
• Exploitation is active. A patch exists but mass compromise was already underway before most operators updated.
• Roughly 4,000 sites run the plugin, most of them small businesses collecting contact, lead and payment data.
• Compromised sites face personal data breach obligations in the EU, UK, Australia and across US state regimes.
• Affected operators should update, rotate every credential, and audit for webshells before reconstructing what was taken.

Attackers are exploiting a critical remote code execution flaw in Everest Forms Pro, the premium WordPress form-builder plugin, to seize full control of vulnerable sites.

The bug is tracked as CVE-2026-3300 and carries a CVSS score of 9.8. It affects every version of the plugin up to and including 1.9.12. The vendor has shipped a patched build, but exploitation was already underway before most operators applied it. Unauthenticated RCE in a small-footprint plugin, with a patch already available: this is the pattern we flagged in WP Maps Pro on 1 June, and it keeps working because update rates are slow.

Everest Forms Pro has roughly 4,000 active installations. Small by WordPress standards. That population skews toward small businesses running contact forms, lead capture and payment workflows, exactly where a quiet webshell pays off.

What the flaw does

The vulnerability allows unauthenticated remote code execution. An attacker can run arbitrary PHP on the host without credentials, drop a backdoor, pivot into the database, and harvest whatever the form plugin has collected.

What it has collected is the problem.

Forms built with Everest commonly handle names, email addresses, phone numbers, postal addresses and uploaded ID documents. In Pro deployments, payment metadata routed through Stripe or PayPal integrations is also in scope. None of that lives in the plugin long-term, but submissions sit in the WordPress database and in email logs. A site takeover exposes the lot.

Jurisdiction and notification exposure

Operators of compromised sites should assume a personal data breach has occurred and triage accordingly. EU and UK operators face mandatory supervisory-authority notification under GDPR where a breach is likely to cause risk to individuals. Australian operators fall under the OAIC's Notifiable Data Breaches scheme where serious harm is likely. US operators face a patchwork of state attorney-general notification rules, plus FTC scrutiny if misrepresentations about security were made to consumers.

"Sophisticated" this is not. It's an unauthenticated RCE in a plugin, and the patch was available before mass exploitation began.

Should you worry?

If your site ran version 1.9.12 or earlier while publicly reachable, yes. The exposure window matters less than what the forms were collecting during it.

What affected site owners should do

• Update Everest Forms Pro to the patched release immediately. If you cannot patch, deactivate and delete the plugin until you can.
• Treat any site that ran 1.9.12 or earlier while exposed as compromised. Rotate all WordPress admin passwords, API keys and any payment-processor credentials stored in wp-config.php or plugin settings.
• Hunt for unexpected PHP files in wp-content/uploads/, modified .htaccess rules, and new admin accounts created since the plugin went public-facing.
• Pull the form-submissions table and email logs to determine the categories and volume of personal data potentially accessed. That dataset drives your notification obligations.
• If submissions included payment or government ID data, engage counsel before your jurisdiction's notification window closes.

A forensic image taken now is cheaper than reconstructing the timeline from server logs in three weeks.