# CVE-2026-5096: Everest Forms Server-Side Request Forgery in upload handling

Source: https://junglewise.ai/threats/cve-2026-5096-everest-forms-server-side-request-forgery-in-upload-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-5096 · Severity: medium · CVSS 5.3 · Published 2026-08-28

Everest Forms is a popular WordPress plugin for creating web forms. The plugin contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to trick the WordPress server into making HTTP requests to arbitrary external URLs by submitting a specially crafted form. This could enable attackers to access internal network resources, scan the internal network, or bypass firewall restrictions.

## Quick answers

**Is CVE-2026-5096 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5096 being exploited in the wild.

**How severe is CVE-2026-5096?** Medium severity, with a CVSS score of 5.3, published 28 August 2026.

**Which products and versions are affected?** Klaus Greff Everest Forms up to and including 3.4.4.

**Is there a fix for CVE-2026-5096?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5096 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5096?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) flaw in the `load_previous_field_value()` method of `class-evf-form-task.php`. The method accepts arbitrary URL values from POST data for upload fields without domain validation, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. An unauthenticated attacker can exploit this by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering. This forces the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs, potentially exposing internal network information or enabling interaction with internal services.

## Affected products

- Klaus Greff Everest Forms up to and including 3.4.4

## Timeline

- 2026-08-28: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php](https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/abstracts/class-evf-form-fields-upload.php)
- [https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/class-evf-form-task.php](https://plugins.trac.wordpress.org/browser/everest-forms/trunk/includes/class-evf-form-task.php)