SentinelOne CVE-2026-3300 Vulnerability Database

The Everest Forms Pro plugin for WordPress contains a critical Remote Code Execution vulnerability via PHP Code Injection affecting all versions up to and including 1.9.12 . This vulnerability exists in the Calculation Addon's process_filter() function, which concatenates user-submitted form field values into a PHP code string without proper escaping before passing it to eval() . The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters, enabling unauthenticated attackers to inject and execute arbitrary PHP code on the server.

Unauthenticated attackers can achieve complete server compromise by injecting malicious PHP code through any string-type form field (text, email, URL, select, radio) when a form uses the "Complex Calculation" feature.

This PHP Code Injection vulnerability (CWE-94) allows unauthenticated remote attackers to execute arbitrary code on affected WordPress installations. The vulnerability stems from unsafe use of PHP's eval() function combined with inadequate input sanitization. When a form administrator configures the "Complex Calculation" feature, the plugin processes user-submitted field values by concatenating them directly into a PHP expression string. This string is then passed to eval() for dynamic calculation execution.

The core issue is that sanitize_text_field() , the WordPress function used for input sanitization, does not escape characters that have special meaning in PHP string contexts—most notably single quotes. This allows attackers to break out of the string context and inject arbitrary PHP statements that will be executed by the eval() call.

The root cause is the dangerous combination of unsanitized user input with PHP's eval() function in the process_filter() function. The sanitize_text_field() WordPress sanitization function is designed for display purposes and does not provide adequate protection against code injection attacks. It fails to escape single quotes, backslashes, and other characters that can terminate string literals and introduce new PHP code. This architectural flaw allows user-controlled data to directly influence executed code.

The attack is network-accessible and requires no authentication or user interaction. An attacker identifies a WordPress site running Everest Forms Pro with the Complex Calculation feature enabled on any public-facing form. By submitting a crafted payload containing PHP code injection syntax through any string-type form field (text, email, URL, select, or radio), the malicious input is processed by process_filter() and executed via eval() . This grants the attacker the ability to execute arbitrary PHP code with the web server's privileges, potentially leading to full server compromise, data exfiltration, or lateral movement within the hosting environment.

The vulnerability mechanism involves injecting single quotes to escape the string context, followed by arbitrary PHP statements. When the process_filter() function builds the calculation expression and passes it to eval() , the injected code executes on the server. For detailed technical analysis, refer to the WordPress Plugin Code Review and the Wordfence Vulnerability Report .

Organizations should monitor the Everest Forms Changelog for security patches addressing this vulnerability. The Wordfence Vulnerability Report provides additional details on affected versions and remediation guidance. Until an official patch is released, the following workarounds should be implemented to reduce risk exposure.

Disclaimer : This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.