CVE-2026-5096
Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.
| CWE | CWE-918 |
| Vendor | wpeverest |
| Product | everest forms – contact form, payment form, quiz, survey & custom form builder with ai |
| Published | Aug 28, 2026 |
Get instant alerts for wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with ai
Be the first to know when new medium vulnerabilities affecting wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with ai are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N