News

Threat actors are actively taking advantage of a dangerous vulnerability in Everest Forms Pro, a WordPress plugin installed on roughly 4,000 sites, to run arbitrary code and fully compromise vulnerable servers. The flaw has been tracked as CVE-2026-3300 with a CVSS score of 9.8, and affects every release up to and including 1.9.12. The plugin author issued a fix on March 18, 2026, in version 1.9.13.

Analysis from Wordfence attributes the root cause to the Calculation Addon’s process_filter() routine, which builds a PHP code string by concatenating values entered by users and then evaluates that string with eval() without adequately escaping those inputs. The plugin’s use of sanitize_text_field() does not neutralize single quotes or other characters that carry meaning inside PHP code, making it feasible for unauthenticated attackers to craft string-type form inputs (for example, text, email, URL, select or radio fields) and trigger remote code execution whenever a form uses the “Complex Calculation” option.

If exploited, this bug enables unauthenticated actors to execute arbitrary PHP on the host. That capability can be used to add rogue administrator accounts, drop web shells, and create additional persistence and lateral-movement vectors on the compromised machine. Wordfence observed active exploitation beginning April 13, 2026, and has blocked more than 29,300 individual exploit attempts so far; 16 attempts were recorded in the most recent 24-hour window. The payload most frequently seen tries to provision an admin user named “diksimarina” with the email address [email protected].

Investigators traced attack traffic to a handful of IP addresses, which include:

• 202.56.2.126
• 209.146.60.26
• 15.235.166.18
• 185.78.165.153
• 2402:1f00:8000:800::40db

In a related area of concern, e-commerce security firm Sansec disclosed several skimmer operations that abuse legitimate services as covert infrastructure. One campaign leverages Stripe as both a command-and-control endpoint and a storage location for stolen cards, capitalizing on the trust many sites place in Stripe to evade Content Security Policy (CSP) rules and network filters. Sansec explains that attackers are effectively treating Stripe as free infrastructure – a writable datastore for card data and a code-hosting endpoint for the skimmer – under a domain that many defenses implicitly trust.

The scheme relies on Google Tag Manager (googletagmanager.com) and Stripe’s API domain (api.stripe.com) to load malicious code from a GTM container on every page that includes it. On Magento and Adobe Commerce checkout flows, the loader retrieves an obfuscated skimmer payload stored in a Stripe customer record’s metadata (Sansec cites the customer id cus_TfFjAAZQNOYENR), scrapes payment card details and customer contact data entered by shoppers, and temporarily holds that information in the browser’s localStorage. The data is subsequently exfiltrated back into the attacker’s Stripe account, where each stolen card becomes a “customer” record in the malicious account. After a successful upload the loader removes the localStorage entry to avoid duplicate submissions; the attacker later enumerates their stolen cards via the same API key and endpoint, turning Stripe’s customer database into a durable exfiltration sink.

Sansec’s telemetry shows the Stripe customer record that contained the skimmer was created on December 24, 2025, suggesting the operation could have been active since that date. The company also found another loader variant that uses Google Firestore in lieu of Stripe, but with the same objective: hide traffic in a trusted third-party service that is unlikely to be blocked by online stores.

These discoveries overlap with a broader fraud network dubbed GorgonAgora, which operates thousands of fake .shop storefronts impersonating well-known brands such as Starbucks, Ford, Sony, Mattel, Hasbro, Lego, Disney and Toyota. According to Sansec, the campaign spans 5,714 fraudulent sites that all use the Medusa.js commerce stack and the same custom checkout SDK. Each fake checkout renders a counterfeit Stripe iframe and sends harvested card data over an encrypted WebSocket to a single skimmer server located in Moldova. Exfiltration is performed with an AES-256-GCM payload over WebSocket, and the attacker’s C2 provides a live 3D Secure relay: when a bank issues a 3DS challenge, the operator proxies the challenge back through the fake iframe to the shopper, enabling the transaction to complete while the theft remains hidden.

Site administrators using Everest Forms Pro should upgrade immediately to version 1.9.13 or later and audit any sites for the indicators described above. Retailers and platform operators should also review GTM containers, third-party scripts, and trusted integrations such as Stripe to detect potential skimmers and unauthorized use of account metadata and storage endpoints.