In a significant escalation of the campaign first reported yesterday, the exploitation of CVE-2026-3300 in the Everest Forms Pro WordPress plugin has moved from targeted attacks to a full-scale fleet hijack. Threat actors are now utilizing automated scripts to scan the internet for vulnerable WordPress installations and deploy persistent web shells. These web shells are being used not only for data exfiltration but as nodes in a growing botnet. This botnet, which we are tracking as 'Everest-Net,' is being leveraged for secondary attacks, including DDoS campaigns and the distribution of SEO-poisoned content. The vulnerability itself is a classic unauthenticated remote code execution flaw, stemming from a failure to properly sanitize file upload parameters in the plugin's form handling logic. This allows an attacker to upload a PHP script disguised as a legitimate form attachment and then execute it by navigating to the upload directory. The speed at which this vulnerability was weaponized—less than 48 hours after the first public reports—underscores the efficiency of the modern cybercrime ecosystem. For WordPress administrators, the situation is critical. Simply updating the plugin may not be enough if the site has already been compromised. A thorough forensic audit is required to identify and remove any web shells or unauthorized administrative accounts. This event highlights the systemic risk posed by the WordPress plugin ecosystem. While plugins provide essential functionality, they also represent a massive, decentralized attack surface that is often poorly maintained. Organizations must adopt a more rigorous approach to plugin management, including regular security audits, the use of Web Application Firewalls (WAFs) with virtual patching capabilities, and the implementation of strict file integrity monitoring. The Everest Forms hijack is a stark reminder that in the world of CMS security, a single vulnerable plugin can compromise an entire enterprise's digital footprint.