Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.
Summary
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wpeverest | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | up to 3.4.4 | — | No fix listed | CNA |
- Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI Vendorwpeverest Affected up to 3.4.4 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-5096
- 2026-10-03 Alias added: GHSA-rwq5-pm7m-r7pm
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c5bbf7ed-c154-4153-adbf-59f0f7aa3a18?source=cve
- https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/class-evf-form-task.php#L1448
- https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php#L1196
- https://plugins.trac.wordpress.org/changeset/3507814/
More wpeverest vulnerabilities
- TI-2025-00958 Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion CVSS 3.1CRITICAL 9.8
- TI-2026-02850 Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field CVSS 3.1CRITICAL 9.8
- TI-2026-01188 User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration CVSS 3.1CRITICAL 9.8
- TI-2025-02262 User Registration & Membership < 4.1.3 - Authentication Bypass CVSS 3.1HIGH 8.1
- TI-2025-02232 User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation CVSS 3.1HIGH 8.1
- TI-2022-03588 User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload CVSS 3.1HIGH 7.5
Sources
- CVE-2026-5096 · CVE Program
- CVE-2026-5096 · NVD
- FIRST EPSS
- GHSA-rwq5-pm7m-r7pm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences