CyberRota Analysis
AI-GeneratedThe Everest Forms plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF) due to improper handling of URL values in the `load_previous_field_value()` method, allowing unauthenticated attackers to send malicious URLs through form submissions. This vulnerability can lead to unauthorized outbound HTTP requests from the WordPress server, potentially exposing sensitive information or enabling further attacks. WordPress administrators using affected versions of the plugin should prioritize patching this vulnerability to mitigate the risk of exploitation.
Original NVD Description
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.