The Everest Forms Pro plugin, widely used on WordPress websites, allows users to create forms with ease and flexibility, often employed by site administrators and developers to streamline data collection and management tasks. With a user-friendly interface, the plugin integrates seamlessly into WordPress environments, offering a variety of form fields for comprehensive customization. It is utilized across industries to facilitate user interactions, manage customer feedback, and gather data efficiently. The plugin's popularity stems from its ability to handle complex form needs without requiring extensive technical knowledge from its user base. This makes Everest Forms Pro a favored choice for web developers aiming to enhance site functionality. In essence, it provides necessary tools to simplify the creation and management of advanced online forms.
The vulnerability in Everest Forms Pro stems from its handling of user-submitted data in the Calculation Addon's process_filter() function. Without proper input escaping, arbitrary PHP code can be injected and executed, allowing unauthorized remote users to compromise the system. The issue affects versions up to 1.9.12, mainly due to insufficient validation of form input fields. This flaw is particularly dangerous as it enables attackers to execute scripts on the server side, leading to potential unauthorized data access or system manipulation. Exploitation can occur when a specific form feature is utilized, demonstrating a critical weakness in input sanitization protocols. This vulnerability highlights the importance of stringent input validation in web applications.
The vulnerability details reveal that the calculation feature in Everest Forms Pro is susceptible due to its concatenation of form field values into PHP code without escaping special characters. The improper handling is due to the direct passing of user inputs to the eval() function, making it an ideal target for code injection attacks. Attackers can exploit any form field accepting text to introduce arbitrary PHP commands, bypassing standard user authentication mechanisms. The vulnerable parameter is the user-input data processed by the calculation functionality, impacting the system where the plugin is implemented. Specific form fields like text, email, number, etc., are potential entries for crafted malicious content aiming at RCE.
Exploitability of this vulnerability could lead to significant compromises in system integrity, including unauthorized access to sensitive data, introduction of malware, and full control over the server by an attacker. Malicious entities may execute commands leading to data breaches, defacement, or further compromise of adjacent networked systems. Such a security breach could damage the reputation of businesses relying on WordPress sites with Everest Forms Pro and result in financial losses. Additionally, it could be used as an attack vector for spreading further malicious activities across connected network infrastructures. Preventing such exploitation is crucial to safeguarding the security and reliability of WordPress sites using this plugin.
REFERENCES
- https://www.wordfence.com/threat-intel/vulnerabilities/id/389c0b89-e408-4ad5-9723-a16b745771f0?source=cve
- https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.4.3/includes/class-evf-form-task.php#L584
- https://everestforms.net/changelog/
- https://www.wordfence.com/blog/2026/06/attackers-actively-exploiting-critical-vulnerability-in-everest-forms-pro-plugin/
- Ensure to update to the latest version of the Everest Forms Pro plugin immediately.
- Conduct a security audit of existing forms to check for any unauthorized modifications.
- Implement additional input validation to filter and sanitize user inputs rigorously.
- Limit PHP execution permissions to necessary directories and files only.
- Consider using web application firewalls to monitor and block suspicious form submissions.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →