This article covers two separate vulnerabilities. Everest Forms Pro CVE-2026-3300 permits unauthenticated PHP code execution when a form uses Complex Calculation and is rated CVSS v3.1 9.8 CRITICAL. PHP CVE-2025-14179 is a NUL-byte handling flaw in PDO Firebird when attacker-controlled data is passed through PDO::quote() and embedded in SQL; PHP's CNA rates it CVSS v4.0 7.4 HIGH.
Vulnerability Overview and Scope of Impact
### RCE Vulnerability in WordPress Everest Forms Pro Plugin (CVE-2026-3300)
Everest Forms Pro through 1.9.12 is affected and should be updated to 1.9.13 or later. Forms using Complex Calculation expose the attack path. Affected PDO Firebird branches are PHP 8.2 before 8.2.31, 8.3 before 8.3.31, 8.4 before 8.4.21, and 8.5 before 8.5.6.
### SQL Injection Vulnerability in PHP PDO Firebird Driver (CVE-2025-14179)
A SQL Injection vulnerability (CVE-2025-14179) has been reported in PHP's PDO Firebird driver (PHP versions 8.2.* (prior to 8.2.31), 8.3.* (prior to 8.3.31), 8.4.* (prior to 8.4.21), 8.5.* (prior to 8.5.6)). This vulnerability arises because the PDO Firebird driver improperly handles NULL bytes when preparing SQL queries, potentially allowing attackers to inject carefully crafted strings containing NULL bytes to execute unintended SQL commands. This poses a significant threat to PHP applications connecting to databases.
Specific Impacts and Attack Scenarios
If the Everest Forms Pro plugin vulnerability (CVE-2026-3300) is exploited, an unauthenticated attacker can upload and execute malicious PHP code on the server through forms where the plugin is active and the 'Complex Calculation' feature is in use. This could lead to a complete takeover of the website, creation of administrator accounts, installation of web shells, theft of sensitive data, and even compromise of the entire server.
If the PHP PDO Firebird driver vulnerability (CVE-2025-14179) is exploited, attackers could tamper with SQL queries sent to the database, potentially gaining unauthorized access to sensitive information, modifying data, or deleting data from the database. This could compromise data integrity within the system and lead to information leaks or service disruptions.
Immediate Countermeasures for Engineers
Update Everest Forms Pro to 1.9.13 or later and disable forms using Complex Calculation until updating is complete. Update PDO Firebird to PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6, or a later release in the applicable branch. This is a PDO Firebird implementation flaw, so a generic application-level prepared-statement example alone does not remediate it.
📦