The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is d…

The Everest Forms Pro plugin for WordPress contains a critical remote code execution vulnerability in versions up to 1.9.12. The flaw exists in the Calculation Addon's process_filter() function which concatenates user-submitted form field values into PHP code without proper escaping before passing to eval(). The sanitize_text_field() function fails to escape single quotes and PHP code context characters. Unauthenticated attackers can exploit this by injecting crafted values in string-type form fields when the Complex Calculation feature is enabled, allowing arbitrary PHP code execution on the server.