BleepingComputer reported on June 6, 2026 that attackers are actively exploiting a critical flaw in Everest Forms Pro, a commercial WordPress form-builder add-on. The vulnerability, tracked as CVE-2026-3300, affects versions 1.9.12 and earlier and can allow unauthenticated attackers to execute code on a vulnerable website.
That may sound like a narrow plugin issue, but it points to a larger business problem. Many companies do not treat their public website as part of their normal IT risk review. The site may be managed by a web developer, marketing agency, hosting company, freelancer, or internal employee who is separate from the person managing Microsoft 365, backups, endpoints, or network security.
For a business owner, the practical question is not only whether this one plugin is installed. The question is whether anyone can prove which plugins are installed, who is responsible for updating them, and whether the site has already been checked for signs of compromise.
Why This Matters Beyond WordPress
WordPress powers many small business, nonprofit, healthcare, school, and professional services websites. Contact forms, quote forms, registration forms, payment forms, and intake forms often sit directly in front of customers. If an attacker creates a rogue administrator account or plants a backdoor, the damage can reach beyond the website itself.
A compromised site can be used to change content, redirect visitors, collect form submissions, damage search visibility, send malicious links, or undermine customer trust. Even if the office network is untouched, the business may still have a public-facing incident that affects sales, reputation, privacy obligations, or vendor relationships.
According to the same report, Wordfence telemetry showed exploitation attempts that tried to create a new administrator account on vulnerable sites. That detail matters because it gives owners something concrete to ask about: not just whether a patch was applied, but whether the site was reviewed for unexpected administrator users and suspicious requests.
The Business Decision
If your website is managed by someone outside your core IT provider, do not assume plugin security is covered. Ask who owns that responsibility in writing.
For this specific issue, the immediate decision is whether to request a documented WordPress review. That review should confirm whether Everest Forms Pro is installed, whether it is updated to version 1.9.13 or later, whether the Complex Calculation feature is in use, whether administrator accounts were checked, and whether hosting logs were reviewed for indicators tied to the reported exploitation.
The broader decision is whether your website vendor can provide evidence, not just reassurance. A short email saying the site is fine is not the same as a plugin inventory, update record, administrator-account review, and log check.
Questions to Ask Your Website or IT Provider
- Is Everest Forms Pro installed on any company website? If so, which version is running today?
- Who is responsible for WordPress plugin updates? Confirm whether this belongs to the web vendor, hosting provider, internal staff, MSP, or another party.
- Can you provide a current plugin inventory? The inventory should include active plugins, version numbers, update status, and business owner for each site.
- Were administrator accounts reviewed? Ask whether any unexpected admin users, especially accounts matching published indicators, were found.
- Were hosting and web server logs checked? A patch does not prove the site was clean before the update.
- Are forms collecting sensitive information? If forms collect health, financial, school, donor, client, or employee data, the review should be handled with more urgency.
- What is the normal patch process? Ask how quickly critical plugin updates are applied and how exceptions are documented.
A Practical Next Step
Business owners do not need to personally audit PHP code or WordPress logs. They do need to make sure somebody accountable has done the review and can explain the result clearly.
Start with a simple request: ask your website vendor or IT provider for a one-page WordPress security status summary. It should list the site owner, hosting provider, active form plugins, current versions, last update date, administrator-account review result, backup status, and any follow-up work needed.
If nobody can produce that summary, that is the real risk signal. The issue is not just one vulnerable plugin. It is a gap in ownership around a public system customers already trust.
Sources and further reading