Everest Forms Pro vulnerability fuels wave of WordPress takeovers

Everest Forms Pro vulnerability exploited in the wild

Security researchers have confirmed that CVE-2026-3300, a critical flaw in the Everest Forms Pro plugin, enables attackers to seize complete control of affected WordPress sites. Malicious actors are leveraging this weakness to inject backdoors, alter content, and harvest credentials. According to Reuters, the exploit has been observed in at least ↑ 45% more incidents since its disclosure last week.

“The speed of adoption is alarming,” says cybersecurity analyst Maya Patel.

WordPress administrators are urged to patch immediately, disable the plugin, or replace it with a vetted alternative. Further guidance is available from Bloomberg and the plugin’s official repository. Failure to act could leave sites vulnerable to data theft and defacement.

Intel provided by: Kaelen Frost

Lead Cybersecurity Analyst