dbcve.org
Code InjectionWeakness · CWE-94

CVE-2026-3300

CRITICAL · 9.8 CVSS v3.1 Published 2026-03-31
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the "Complex Calculation" feature.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Everest Forms Pro plugin's Calculation Addon contains a critical PHP code injection vulnerability in the process_filter() function. User-submitted values from string-type form fields (text, email, URL, select, radio) are concatenated into a PHP code string and passed to eval() without proper escaping. Although sanitize_text_field() is applied, it fails to escape single quotes and other PHP context characters, allowing unauthenticated attackers to execute arbitrary PHP code when a form uses the Complex Calculation feature.

MitigationImmediately update to the latest patched version of Everest Forms Pro once available, or disable the Complex Calculation feature as a temporary measure. Consider deploying a WAF rule to block requests containing PHP code patterns in form fields until the patch is applied.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Confirm Everest Forms Pro is installed
    In WordPress admin, go to Plugins > Installed Plugins and locate Everest Forms Pro. Note the installed version number.
    Affected if The plugin is installed and active.
  2. Compare your installed version
    Compare the installed version number to the latest patched version available from the WordPress plugin repository or Everest Forms release notes.
    Affected if Your version is older than the patched version.
  3. Identify forms using Complex Calculation
    In Everest Forms Pro, navigate to Forms and review each form. Check if any form has the Complex Calculation feature enabled in the form settings or calculation fields.
    Affected if At least one form has Complex Calculation enabled.
  4. Check for string-type fields in calculated forms
    For forms with Complex Calculation enabled, examine the fields used in calculations. Look for text, email, URL, select, or radio type fields that are included in calculation expressions.
    Affected if String-type fields (text, email, URL, select, radio) are used within Complex Calculations.
  5. Review form submissions for injection patterns
    Examine recent form submissions in the WordPress dashboard under Everest Forms > Entries. Look for unexpected characters like single quotes, semicolons, or PHP function names in fields that feed into calculations.
    Affected if Form submission data contains PHP code patterns or unexpected syntax in calculation-linked fields.

You are affected if Everest Forms Pro is installed with Complex Calculation enabled on forms that include string-type fields (text, email, URL, select, radio) in their calculations.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Immediately update to the latest patched version of Everest Forms Pro once available, or disable the Complex Calculation feature as a temporary measure. Consider deploying a WAF rule to block requests containing PHP code patterns in form fields until the patch is applied.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation1.0 h
  • Testing2.0 h
  • Review / QA1.0 h
6.0 hours of engineering $1,060
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,696.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-3300 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-3300 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data