Everest Forms Pro flaw exploited to hijack WordPress sites

Hackers are actively exploiting CVE-2026-3300 in Everest Forms Pro versions 1.9.12 and earlier to take over WordPress sites without authentication. The vulnerability resides in the Complex Calculation feature, which passes user input through sanitize_text_field but fails to escape single quotes, allowing PHP code injection via eval. Attackers inject code that calls wp_insert_user to create rogue admin accounts like 'diksimarina'.