Description

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-28T16:18:18.820Z",
  "pubdate": "2026-08-28T16:18:18.820Z",
  "executiveSummary": "The Everest Forms WordPress plugin is susceptible to an unauthenticated Server-Side Request Forgery (SSRF) vulnerability affecting versions up to and including 3.4.4.\nThe flaw exists due to inadequate validation of user-supplied input within the plugin's form handling logic, specifically concerning upload field processing.\nAn unauthenticated attacker can exploit this vulnerability to force the host WordPress server to execute unauthorized HTTP HEAD requests against arbitrary internal or external network resources.\nThis vulnerability poses a significant risk to organizational security, potentially enabling attackers to perform reconnaissance on internal network infrastructure, bypass firewall restrictions, or interact with services restricted to the local network environment.\nExploitation requires no prior authentication or administrative privileges, as the trigger mechanism involves submitting a specifically crafted form that initiates server-side processing of malicious URLs.\nThe impact includes information leakage, potential interaction with internal metadata services, and the ability to scan local network segments from the perspective of the web server.",
  "technicalDetails": "The vulnerability resides in the interaction between the 'load_previous_field_value()' method located in 'class-evf-form-task.php' and the 'get_local_file_size()' method defined in 'class-evf-form-fields-upload.php'.\nThe root cause is the improper handling of '$_POST' data containing arbitrary URL inputs associated with form upload fields. The 'load_previous_field_value()' function fails to implement sufficient domain restrictions or input sanitization before passing these user-controlled URLs to subsequent processing routines.\nWhen a user submits a form, the application attempts to re-render the fields if a required field is left empty. During this process, the plugin triggers 'load_previous_field_value()', which retrieves the user-supplied URL from the '$_POST' request and forwards it to the 'get_local_file_size()' function.\nThe 'get_local_file_size()' method proceeds to pass the unvalidated URL directly into 'wp_remote_head()', a WordPress core function designed to perform HTTP HEAD requests. Because there is no allow-list or protocol filtering applied to these inputs, the plugin instructs the server to perform an outbound request to the specified target.\nThe attack flow is initiated by an unauthenticated actor crafting a malicious form submission. The attacker targets an Everest Form containing an upload component, populates the URL parameter with a desired target (such as an internal IP address, a cloud metadata service endpoint, or a target URL for an external service), and deliberately omits a required field to force the application to re-render the form state.\nUpon re-rendering, the application backend consumes the malicious URL and executes the HTTP HEAD request. The server's response or the resulting errors—if observable by the attacker—can facilitate network reconnaissance or interaction with services that are otherwise protected by an external firewall but reachable from the WordPress host.\nThis vulnerability is strictly an SSRF vector and does not provide direct remote code execution; however, the ability to initiate arbitrary outbound requests provides an attacker with a foothold to exploit other internally exposed vulnerabilities or gather sensitive information from the internal network landscape."
}