CVE-2026-3300 is a critical remote code execution vulnerability in the Everest Forms Pro WordPress plugin (up to version 1.9.12). The issue arises from the Calculation Addon's process_filter() function, which improperly concatenates user input into PHP code strings and executes them via eval() without adequate escaping. The sanitize_text_field() function applied to inputs fails to escape single quotes and other PHP code context characters, enabling unauthenticated attackers to inject arbitrary PHP code through crafted values in string-type form fields (text, email, URL, select, radio) when the "Complex Calculation" feature is used.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code on the server hosting the vulnerable plugin. This can lead to full system compromise including data theft, site defacement, malware installation, or further pivoting within the hosting environment. The CVSS 3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability with no required privileges or user interaction.

No official patch or fix is currently available as per the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to disable the "Complex Calculation" feature or remove the Everest Forms Pro plugin from affected versions to prevent exploitation. Monitor the vendor's official channels for updates and apply patches promptly once available.