Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-5096— Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'

Quick assessment

Affected
wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress Everest Forms是WordPress基金会的一个人工智能辅助的联系表单、支付表单、测验、调查和自定义表单构建器。 WordPress Everest Forms 3.4.4及之前版本存在服务端请求伪造漏洞，该漏洞源于load_previous_field_value()方法接受来自$_POST数据的上传字段任意URL值且无域名限制，并传递给wp_remote_head()，可能导致未认证攻击者强制服务器向任意URL发起出站HTTP HEAD请求，造成服务端请求伪造。

CVSS 5.3 · Medium EPSS 0.41% · P33

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI ≤ 3.4.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-5096

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
Source: CVE Program / CVE List V5
Vulnerability Description
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Everest Forms 服务端请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Everest Forms是WordPress基金会的一个人工智能辅助的联系表单、支付表单、测验、调查和自定义表单构建器。 WordPress Everest Forms 3.4.4及之前版本存在服务端请求伪造漏洞，该漏洞源于load_previous_field_value()方法接受来自$_POST数据的上传字段任意URL值且无域名限制，并传递给wp_remote_head()，可能导致未认证攻击者强制服务器向任意URL发起出站HTTP HEAD请求，造成服务端请求伪造。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI 0 ~ 3.4.4 -

II. Public POCs for CVE-2026-5096

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-5096

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-5096 (1)

IV. Related Vulnerabilities

Same product: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Same vendor: wpeverest
Same weakness: CWE-918

V. Comments for CVE-2026-5096

No comments yet

Leave a comment