The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue() method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction, which are then passed to wpremotehead() in the getlocalfilesize() method of class-evf-form-fields-upload.php. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.