A form plugin bug turned user input into PHP execution, so an unauthenticated request could become full WordPress takeover. The standard fix is not just patching the plugin, because a successful hit can leave behind rogue admin accounts and webshells that keep the site compromised after the code is updated.
The flaw is in Everest Forms Pro’s Complex Calculation feature. It affects version 1.9.12 and earlier, is tracked as CVE-2026-3300, and was patched in 1.9.13. Wordfence says it has already blocked more than 29,300 exploit attempts, with attackers using the bug to register a fake administrator account and push the campaign at scale across a product with about 4,000 active installs.
The risk now is not just exposure to a bad form submission. Any affected site needs to assume admin credentials or backdoor access may already exist, because patching closes the hole but does not remove what attackers created through it.