Home / Technology / WordPress Plugin Hack: Admin Hijacked!
WordPress Plugin Hack: Admin Hijacked!
9 Jun
Summary
- A critical RCE flaw in Everest Forms Pro allows hackers to hijack sites.
- Attackers create a rogue admin account named 'diksimarina' via PHP injection.
- Nearly 30,000 takeover attempts were blocked by security researchers.
Security researchers are sounding the alarm about an ongoing cyberattack campaign exploiting a critical vulnerability in the popular Everest Forms Pro WordPress plugin. This flaw, identified as CVE-2026-3300, is a Remote Code Execution (RCE) bug with a severity rating of 9.8 out of 10, affecting all versions up to and including 1.9.12.
The vulnerability allows attackers to inject PHP code to create a new administrator account, typically named 'diksimarina.' This allows them to gain full control over the affected website, potentially leading to data exfiltration, malware distribution, or visitor redirection. The bug was initially disclosed in February of this year, with a fix released by the developer by mid-March. Exploitation attempts began in mid-April, and nearly 30,000 such attempts have been thwarted, primarily originating from two specific IP addresses.
Website administrators are strongly advised to update their Everest Forms Pro plugin immediately to a patched version. Furthermore, blocking the identified malicious IP addresses (202.56.2[.]126 and 209.146.60.26) and reviewing server logs for the string 'diksimarina' are crucial steps to detect and prevent potential compromises.
