{"id":"CVE-2026-5096","aliases":["EUVD-2026-67710","GHSA-rwq5-pm7m-r7pm"],"status":"published","title":"Everest Forms \u003c= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'","description":"The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0041,"percentile":0.35541,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2026-08-28T11:29:29Z","modified":"2026-08-28T20:19:02Z","products":[{"vendor":"wpeverest","product":"everest forms – contact form, payment form, quiz, survey \u0026 custom form builder with ai"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c5bbf7ed-c154-4153-adbf-59f0f7aa3a18?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/class-evf-form-task.php#L1448"},{"url":"https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php#L1196"},{"url":"https://plugins.trac.wordpress.org/changeset/3507814/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5096"},{"url":"https://plugins.trac.wordpress.org/changeset/3507814"},{"url":"https://github.com/advisories/GHSA-rwq5-pm7m-r7pm"}],"sources":{"cve":[{"id":"CVE-2026-5096","title":"Everest Forms \u003c= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'","description":"The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.","status":"published","published":"2026-08-28T11:29:29.094Z","modified":"2026-08-28T18:35:55.807Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T13:39:27.849196Z"}],"euvd":[{"id":"EUVD-2026-67710","description":"The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.","status":"published","published":"2026-08-28T11:29:29Z","modified":"2026-08-28T18:35:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:22.342607Z"}],"ghsa":[{"id":"GHSA-rwq5-pm7m-r7pm","title":"The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all...","description":"The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.","status":"published","published":"2026-08-28T18:31:29Z","modified":"2026-08-28T18:31:30Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:11:07.541511Z"}],"nvd":[{"id":"CVE-2026-5096","description":"The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.","status":"published","published":"2026-08-28T16:18:18.82Z","modified":"2026-08-28T20:19:02.463Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:42.366888Z"}]}}