CVE-2026-3300 Unauthenticated Remote Code Execution via Form Calculation

CVE-2026-3300 is a critical-severity vulnerability. AttackerView checks WordPress sites for it with a live exploit check.

Is my site vulnerable to CVE-2026-3300?

Detects WordPress installs running the Everest Forms Pro plugin at version 1.9.12 or earlier. The Calculation Addon's process_filter() function concatenates user-submitted form field values into a PHP code string and passes it to eval(). sanitize_text_field() does not escape single quotes, allowing unauthenticated attackers to break out of the string context and inject arbitrary PHP code — enabling full server compromise.