The vulnerability allows an unauthenticated attacker to inject arbitrary PHP code by submitting specially crafted values in any string‑type form field when the Complex Calculation feature is enabled. The plugin’s processing concatenates the unescaped input into a PHP code string and passes it to eval(), enabling the execution of attacker‑supplied code on the web server. This flaw directly compromises the confidentiality, integrity, and availability of the affected WordPress site, allowing full system takeover.

Vulnerable installations of the Everest Forms Pro WordPress plugin up to and including version 1.9.12 are affected. All WordPress sites that load any of these plugin versions and use the Complex Calculation feature in their forms are at risk. The impact is limited to installations running the specified plugin versions; newer releases are not impacted.

The CVSS base score of 9.8 indicates critical severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog; however, the large attack surface of WordPress and the lack of required authentication make exploitation likely if an attacker can submit data to the form. Exploitation requires only the ability to send a crafted form submission, which is typically possible from any external source.