CVE-2026-5096: Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue() method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction, which are then passed to wpremotehead() in the getlocalfilesize() method of class-evf-form-fields-upload.php. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Everest Forms (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.4.4 - Compensating control
As a compensating control until patched, restrict outbound HTTP(S) traffic from the WordPress server (e.g., via firewall/egress rules) so wp_remote_head() cannot reach arbitrary external URLs.
Event History
Frequently Asked Questions
What conditions must be present for an attacker to exploit this issue?
The site must expose an Everest Forms form containing an upload field. An unauthenticated attacker can submit that form with a malicious URL as the upload field's previous value and leave a required field empty so the form is re-rendered.
What can an attacker make the affected server do?
An attacker can cause the WordPress server to send outbound HTTP HEAD requests to arbitrary URLs. The described impact is limited to server-side requests; no integrity or availability impact is stated.
Are sites using the affected plugin exposed by default?
Exposure depends on whether an Everest Forms form with an upload field is available for submission. The described attack does not require authentication, but it relies on being able to submit such a form and trigger validation failure through an empty required field.
Which plugin versions are affected?
Everest Forms versions up to and including 3.4.4 are affected.