The Everest Forms plugin for WordPress contains a Server-Side Request Forgery vulnerability (CWE-918) identified as CVE-2024-1812. This vulnerability allows unauthenticated attackers to abuse the 'font_url' parameter to force the server to send requests to arbitrary locations. Such SSRF can be leveraged to access or manipulate internal network resources that are otherwise inaccessible externally. The issue affects all plugin versions up to 2.0.7. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope change.

An attacker can exploit this SSRF vulnerability to make the server perform unauthorized requests to internal or external systems. This may allow information disclosure or modification of internal services, potentially leading to further compromise within the affected environment. The vulnerability does not directly impact availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the vulnerable plugin or disabling it if feasible to reduce exposure.