The world of cybersecurity is a complex and ever-evolving landscape, and the recent news of hackers exploiting a critical vulnerability in the Everest Forms Pro WordPress plugin highlights the ongoing battle between those who protect our digital assets and those who seek to exploit them. This incident serves as a stark reminder of the importance of vigilance and proactive security measures in the face of evolving threats.
A Critical Vulnerability
The vulnerability in question, CVE-2026-3300, is a remote code execution bug that impacts all versions of the Everest Forms Pro plugin up to and including 1.9.12. With a CVSS score of 9.8, this flaw is considered extremely critical, as it allows unauthenticated attackers to inject and execute arbitrary PHP code on the server. The issue stems from the plugin's Calculation Addon's process_filter() function, which concatenates user-submitted form field values into a PHP code string without proper escaping before passing it to eval().
This means that attackers can manipulate form fields, such as text, email, URL, select, and radio inputs, to inject malicious code. The sanitizetextfield() function fails to escape single quotes or other PHP code context characters, creating a gateway for unauthorized access. Once exploited, this vulnerability can lead to severe consequences, including the creation of rogue administrator accounts, deployment of web shells, and the establishment of persistent footholds on the compromised server.
The Attack Unveiled
Wordfence, a WordPress security company, has been monitoring the situation and reported that attackers have been actively exploiting this flaw since April 13, 2026. The company has blocked over 29,300 exploit attempts, with 16 of these attacks occurring in the last 24 hours. The most common payload involves the creation of an administrator account named 'diksimarina' with the email address 'diksimarina@gmail.com'. The attack attempts have originated from various IP addresses, including 202.56.2.126, 209.146.60.26, 15.235.166.18, 2402:1f00:8000:800::40db, and 185.78.165.153.
Skimmer Attacks Exploit Stripe
In a separate but equally concerning development, Sansec has warned of multiple skimmer campaigns, one of which leverages Stripe as a command-and-control (C2) server and data exfiltration sink. The attackers exploit the trust placed in Stripe by online stores, using Google Tag Manager (GTM) and Stripe domains, such as googletagmanager.com and api.stripe.com, which are implicitly trusted by e-commerce platforms.
The malicious code is loaded from a GTM container and executed on every page that loads it, particularly on Magento and Adobe Commerce checkout pages. It extracts an obfuscated skimmer from a Stripe customer account's metadata field and saves sensitive user data, including financial information, billing and email addresses, and phone numbers, to localStorage. The captured data is then exfiltrated back to the attacker's Stripe account.
Sansec's research also uncovered a second variant of the loader that uses Google Firestore instead of Stripe, showcasing the attackers' ability to abuse trusted services as covert channels. This discovery coincides with the large-scale operation known as GorgonAgora, which has been active since August 2025, using a cluster of 5,714 fake .shop storefronts to impersonate well-known brands and funnel stolen card data to a single skimmer server in Moldova.
Implications and Takeaways
These incidents underscore the importance of staying vigilant and proactive in cybersecurity. As attackers continue to evolve their tactics, it is crucial to keep software up to date, implement robust security measures, and educate users about potential threats. The exploitation of the Everest Forms Pro plugin and the skimmer attacks on Stripe demonstrate the need for constant vigilance and the importance of treating security vulnerabilities with the utmost urgency.
In my opinion, these attacks highlight the ongoing arms race between cybersecurity professionals and threat actors. As we enhance our defenses, attackers adapt, finding new ways to exploit vulnerabilities. It is a constant battle, and the consequences of successful attacks can be devastating. Therefore, staying informed, implementing best practices, and fostering a culture of security awareness are essential components of safeguarding our digital world.
