What the vulnerability does
01Description
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.
Explanation of Vulnerability in Simple Terms
02Summary
Everest Forms versions 3.4.4 and earlier contain a server-side request forgery vulnerability that allows unauthenticated attackers to make the site send HTTP requests to internal or external systems on the attacker's behalf. The vulnerability requires no user interaction and can be exploited over the network. An attacker can read limited information from responses, such as internal service metadata or error messages.
What an attacker can do
03Attacker Capabilities
Make your site send HTTP requests to internal systems or external servers and read limited response data.
Potential impact on your site
04Site Impact
Attackers can probe your internal network, access cloud metadata services, or trigger actions on connected systems without your knowledge.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 28, 2026
CVE published
August 28, 2026
Record updated
