CVE-2026-5096

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the load previous field value() method in class-evf-form-task.php accepting arbitrary URL values from $ POST data for upload fields without domain restriction, which are then passed to wp remote head() in the get local file size() method of class-evf-form-fields-upload.php. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.