TECH NEWS

Everest Forms Vulnerability Exploited to Hack WordPress Sites

https://www.securityweek.com/wp-content/uploads/2024/08/WordPress.jpeg

A critical-severity vulnerability in the Everest Forms Pro WordPress plugin has been exploited in the wild for months for site takeover, Defiant warns.

Present on more than 100,000 WordPress websites, Everest Forms is designed for creating contact forms, order forms, payment forms, and surveys.

Tracked as CVE-2026-3300 (CVSS score of 9.8), the security defect allows unauthenticated, remote attackers to inject PHP code into form fields using the Complex Calculation feature.

Although user input is sanitized, a vulnerable function in the plugin does not escape single quotes and other characters, and adds the provided values to a PHP code string.

A remote, unauthenticated attacker can supply a value containing a single quote followed by malicious PHP code and a comment character, which results in the injection of PHP code that is executed on the server.

“This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the...

Copyright of this story solely belongs to securityweek.com. To see the full text click HERE

Read more