Read the docs
TI-2026-02850 Aliases CVE-2026-3300GHSA-jfqc-5rvh-wp99

Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field

Priority HIGH 76CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the "Complex Calculation" feature.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.39159 98th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wpeverestEverest Forms Proup to 1.9.12—No fix listedCNA
  • Everest Forms Pro Vendorwpeverest Affected up to 1.9.12 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3300
  2. 2026-10-03 Alias added: GHSA-jfqc-5rvh-wp99
  3. 2026-10-25 EPSS moved to the 95th–99th percentile
  4. 2026-10-25 Priority changed: MEDIUM → HIGH

References

Other 3

  • TI-2025-00958 Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion CVSS 3.1CRITICAL 9.8
  • TI-2026-01188 User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration CVSS 3.1CRITICAL 9.8
  • TI-2025-02262 User Registration & Membership < 4.1.3 - Authentication Bypass CVSS 3.1HIGH 8.1
  • TI-2025-02232 User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation CVSS 3.1HIGH 8.1
  • TI-2022-03588 User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload CVSS 3.1HIGH 7.5
  • TI-2026-02846 Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata CVSS 3.1CRITICAL 9.8
See all 80 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences