Critical Everest Forms Pro WordPress RCE (CVE‑2026‑3300) Actively Exploited, Patch Now
A critical RCE flaw (CVE‑2026‑3300, CVSS 9.8) in the Everest Forms Pro WordPress plugin is being actively exploited, allowing unauthenticated attackers to run arbitrary PHP, create admin accounts, and install webshells. The bug affects all versions ≤1.9.12 and has generated over 29k blocked attempts; users must update to 1.9.13 immediately.