CVE-2026-3300 is a critical remote code execution vulnerability in the Everest Forms Pro WordPress plugin affecting all versions up to 1.9.12. The vulnerability arises from the Calculation Addon's process_filter() function, which concatenates user input from string-type form fields into PHP code and executes it using eval() without sufficient escaping. The sanitize_text_field() function used does not prevent injection of PHP code context characters, enabling unauthenticated attackers to inject arbitrary PHP code by submitting crafted input in forms using the "Complex Calculation" feature.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code on the web server hosting the vulnerable plugin. This can lead to full compromise of the affected WordPress site, including data theft, site defacement, or further pivoting within the hosting environment. The CVSS score of 9.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the "Complex Calculation" feature or avoid using the Calculation Addon to prevent exploitation. Monitoring vendor channels for updates and applying patches promptly once released is critical.