【URGENT】Critical Vulnerabilities in WordPress Plugin 'Everest Forms Pro' and PHP PDO Firebird Driver: Take Action Against Attacks Now!

Within the past 24 hours, critical security vulnerabilities have been announced in a widely used WordPress plugin for web development and a core PHP component, with some already being actively exploited in cyberattacks. Specifically, a critical Remote Code Execution (RCE) vulnerability (CVE-2026-3300) allowing unauthenticated attackers to execute arbitrary code has been identified in the WordPress 'Everest Forms Pro' plugin, requiring urgent attention. Furthermore, a SQL Injection vulnerability (CVE-2025-14179) has been reported in PHP's PDO Firebird driver, potentially affecting all systems using PHP. To protect systems from these threats, engineers must immediately implement the recommended mitigation measures.

Vulnerability Overview and Scope of Impact

### RCE Vulnerability in WordPress Everest Forms Pro Plugin (CVE-2026-3300)

A critical Remote Code Execution (RCE) vulnerability (CVE-2026-3300) exists in the multi-purpose form builder plugin for WordPress, 'Everest Forms Pro' (versions 1.9.12 and earlier). This vulnerability stems from the `process_filter()` function in the Calculation Addon, which concatenates user-submitted form field values into a PHP code string without proper escaping, then executes it with the `eval()` function. Even when `sanitize_text_field()` is applied, single quotes and other PHP code context characters are not escaped, allowing unauthenticated attackers to inject and execute arbitrary PHP code. According to Wordfence, 16 attacks targeting this vulnerability have been observed within the past 24 hours.

### SQL Injection Vulnerability in PHP PDO Firebird Driver (CVE-2025-14179)

A SQL Injection vulnerability (CVE-2025-14179) has been reported in PHP's PDO Firebird driver (PHP versions 8.2.* (prior to 8.2.31), 8.3.* (prior to 8.3.31), 8.4.* (prior to 8.4.21), 8.5.* (prior to 8.5.6)). This vulnerability arises because the PDO Firebird driver improperly handles NULL bytes when preparing SQL queries, potentially allowing attackers to inject carefully crafted strings containing NULL bytes to execute unintended SQL commands. This poses a significant threat to PHP applications connecting to databases.

Specific Impacts and Attack Scenarios

If the Everest Forms Pro plugin vulnerability (CVE-2026-3300) is exploited, an unauthenticated attacker can upload and execute malicious PHP code on the server through forms where the plugin is active and the 'Complex Calculation' feature is in use. This could lead to a complete takeover of the website, creation of administrator accounts, installation of web shells, theft of sensitive data, and even compromise of the entire server.

If the PHP PDO Firebird driver vulnerability (CVE-2025-14179) is exploited, attackers could tamper with SQL queries sent to the database, potentially gaining unauthorized access to sensitive information, modifying data, or deleting data from the database. This could compromise data integrity within the system and lead to information leaks or service disruptions.

Immediate Countermeasures for Engineers

### 1. Urgent WordPress Plugin Update

WordPress site administrators using the 'Everest Forms Pro' plugin must **immediately update to version 1.9.13 or later**. If updating is not feasible, temporarily disabling the plugin is strongly recommended.

### 2. PHP Version Update

For PHP environments using the PDO Firebird driver, please **update PHP to the following versions**. GovCERT.HK also recommends security updates for multiple PHP vulnerabilities.

* PHP 8.2: 8.2.31 or later

* PHP 8.3: 8.3.31 or later

* PHP 8.4: 8.4.21 or later

* PHP 8.5: 8.5.6 or later

### 3. Secure Coding Practices (PHP)

To prevent vulnerabilities like SQL injection when interacting with databases in PHP, always use prepared statements and consistently sanitize and escape user input. Below is a basic example of how to prevent SQL injection using PDO and prepared statements in PHP.

<?php
$dsn = 'mysql:host=localhost;dbname=testdb;charset=utf8mb4';
$username = 'dbuser';
$password = 'dbpass';

try {
    $pdo = new PDO($dsn, $username, $password, [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_EMULATE_PREPARES => false,
    ]);

    // ユーザーからの入力 (例: $_GET['id'])
    $userId = $_GET['id'] ?? null;

    if ($userId !== null) {
        // プリペアドステートメントを使用
        $stmt = $pdo->prepare('SELECT * FROM users WHERE id = :id');
        $stmt->bindParam(':id', $userId, PDO::PARAM_INT);
        $stmt->execute();
        $user = $stmt->fetch(PDO::FETCH_ASSOC);

        if ($user) {
            echo 'ユーザー名: ' . htmlspecialchars($user['name']);
        } else {
            echo 'ユーザーが見つかりません。';
        }
    } else {
        echo 'IDが指定されていません。';
    }

} catch (PDOException $e) {
    error_log('Database Error: ' . $e->getMessage());
    echo 'データベースエラーが発生しました。';
}
?>

This code safely processes the user ID using a placeholder (`:id`) and `bindParam`, rather than embedding it directly into the SQL query. This prevents malicious SQL code from being injected.

### 4. Implement a WAF (Web Application Firewall)

Consider implementing a WAF as an additional layer of protection against these vulnerabilities. A WAF helps mitigate attacks on unpatched systems by detecting and blocking malicious HTTP requests.

Reference Sources and Official Patch Information