CVE-2024-1812: Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'fonturl' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1812?
CVE-2024-1812 is considered a high-severity vulnerability due to its potential for exploitation via Server-Side Request Forgery.
How do I fix CVE-2024-1812?
To fix CVE-2024-1812, update the Everest Forms plugin for WordPress to version 2.0.8 or higher.
Who is affected by CVE-2024-1812?
All versions of the Everest Forms plugin for WordPress up to and including 2.0.7 are affected by CVE-2024-1812.
What type of vulnerability is CVE-2024-1812?
CVE-2024-1812 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
Can CVE-2024-1812 be exploited by authenticated users?
CVE-2024-1812 can be exploited by unauthenticated attackers, making it particularly dangerous.