Hackers Exploit Critical Everest Forms Pro Word Press Plugin Flaw to Take Over Sites

Summary: Attackers are actively exploiting CVE-2026-3300, a remote code execution flaw with a CVSS score of 9.8 in the Everest Forms Pro WordPress plugin, affecting all versions up to and including 1.9.12; a patch shipped on March 18, 2026 in version 1.9.13. Wordfence reports exploitation began April 13, 2026, with more than 29,300 exploit attempts blocked to date, the most common payload creating an administrator account named "diksimarina" with the email address diksimarina@gmail.com.
What you should know: The plugin has roughly 4,000 active installations, and a single crafted form field is enough for an unauthenticated attacker to create a rogue administrator account or deploy a web shell, so any site still on 1.9.12 or earlier is exposed until it updates.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-3300
Related: ⚡ Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026