CVE-2026-5096: CWE-918 Server-Side Request Forgery (SSRF) in wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI

CVE-2026-5096 is a Server-Side Request Forgery vulnerability in the Everest Forms WordPress plugin (up to version 3.4.4). The vulnerability is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from POST data for upload fields without restricting the domain. These URLs are then passed to the `wp_remote_head()` function in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. An unauthenticated attacker can exploit this by submitting a form with an upload field containing a malicious URL and leaving a required field empty to trigger form re-rendering, causing the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs.

An unauthenticated attacker can abuse this vulnerability to make the WordPress server send HTTP HEAD requests to arbitrary external URLs. This could potentially be used to scan internal networks, access internal resources, or perform other SSRF-related attacks. The confidentiality impact is low, with no direct integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable form or disabling the upload field functionality in Everest Forms. Monitor vendor channels for updates and apply patches promptly once released.