CVE-2026-5096: Everest Forms WordPress Plugin SSRF Vulnerability

CVE-2026-5096 Overview

The Everest Forms plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability affecting all versions up to and including 3.4.4. The flaw resides in the load_previous_field_value() method within class-evf-form-task.php, which accepts arbitrary URL values from $_POST data for upload fields without domain restriction. Those URLs flow into wp_remote_head() inside the get_local_file_size() method of class-evf-form-fields-upload.php. Unauthenticated attackers can force the WordPress server to issue outbound HTTP HEAD requests to arbitrary destinations. The issue is tracked as CWE-918.

Critical Impact
Unauthenticated attackers can coerce vulnerable WordPress sites into probing internal network resources and metadata endpoints via HTTP HEAD requests.

Affected Products

WordPress Everest Forms plugin, all versions up to and including 3.4.4
WordPress installations exposing forms with upload fields
Environments where the plugin can reach internal services or cloud metadata endpoints

Discovery Timeline

2026-08-28 - CVE-2026-5096 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-5096

Vulnerability Analysis

The vulnerability is a classic Server-Side Request Forgery condition in a form-processing workflow. When a user submits an Everest Forms form containing an upload field, the plugin re-renders the form if a required field is left empty. During re-rendering, load_previous_field_value() reads the prior upload value directly from $_POST and passes the URL to the upload field class. The get_local_file_size() method then calls wp_remote_head() against that URL to determine the file size. Because the plugin does not restrict the URL to trusted domains or validate that the host points to previously uploaded content, an attacker controls the destination of the outbound request. The attack requires no authentication and no user interaction beyond submitting a crafted form.

Root Cause

The root cause is missing domain and scheme validation on user-controlled input reaching an HTTP client function. load_previous_field_value() trusts $_POST data without ensuring the URL originates from the WordPress uploads directory. Because wp_remote_head() follows the supplied URL directly, attackers can substitute internal IP addresses, localhost services, or cloud provider metadata endpoints.

Attack Vector

An unauthenticated attacker locates any published Everest Forms form containing an upload field and at least one required field. The attacker crafts a POST request supplying a malicious URL for the upload field value while leaving a required field empty to trigger the re-rendering path. The WordPress server then performs an HTTP HEAD request to the attacker-specified destination, which can be used to probe internal network topology, fingerprint services, or interact with metadata endpoints reachable from the server.

See the WordPress Everest Forms Upload Code and WordPress Everest Forms Task Code for the vulnerable code paths.

Detection Methods for CVE-2026-5096

Indicators of Compromise

Outbound HTTP HEAD requests from the WordPress web server to internal RFC1918 addresses, 127.0.0.1, or cloud metadata addresses such as 169.254.169.254.
POST requests to Everest Forms submission endpoints containing upload field values pointing to hosts outside the WordPress wp-content/uploads/ path.
Web server access logs showing repeated form submissions with empty required fields and varying upload URL parameters.

Detection Strategies

Inspect PHP process network telemetry for wp_remote_head()-generated traffic egressing to non-media hosts.
Correlate WordPress request logs with outbound firewall logs to identify form submissions immediately followed by suspicious server-initiated HTTP HEAD requests.
Alert on any WordPress server reaching cloud instance metadata services, which is almost never legitimate for a form plugin.

Monitoring Recommendations

Enable egress logging on WordPress hosts and restrict outbound HTTP to an allowlist of known media and update endpoints.
Monitor Everest Forms submission endpoints for anomalous POST bodies containing external URLs in upload field parameters.
Track file integrity of the Everest Forms plugin directory to detect version drift after remediation.

How to Mitigate CVE-2026-5096

Immediate Actions Required

Update the Everest Forms plugin to a version later than 3.4.4 that incorporates the fix from WordPress Changeset #3507814.
Audit all published forms for upload fields and temporarily disable public access if patching cannot occur immediately.
Block outbound access from the WordPress server to internal ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16) at the network layer.

Patch Information

The Everest Forms maintainers addressed the SSRF in the changeset published as WordPress Changeset #3507814. Additional context is available in the Wordfence Vulnerability Report. Administrators should upgrade to the fixed release via the WordPress plugin repository and confirm the plugin version in wp-admin after the update.

Workarounds

Deploy a Web Application Firewall rule that rejects Everest Forms submissions where upload field values contain URLs outside the site's own uploads directory.
Restrict PHP outbound network access using host firewall rules or a forward proxy that enforces destination allowlisting.
Require authentication in front of forms containing upload fields until the plugin is upgraded.

bash

# Example iptables rules blocking WordPress egress to cloud metadata and internal ranges
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT