The exploitation of a serious security flaw, identified as CVE-2026-3300, in the Everest Forms Pro WordPress plugin has been reported, with over 29,300 attempts thwarted. The vulnerability, which carries a CVSS score of 9.8, affects all versions up to 1.9.12 and allows unauthorized attackers to execute arbitrary code, potentially compromising entire websites.
Wordfence noted that a patch was released on March 18, 2026, addressing the issue in version 1.9.13. Attackers began exploiting the flaw on April 13, 2026, with the most common tactic involving the creation of rogue administrator accounts.
Recent statistics revealed that 16 of these attacks occurred within the last 24 hours, with attempts originating from various IP addresses. The vulnerability allows for significant server breaches, including the installation of web shells and the establishment of persistent access points.