The Everest Forms plugin for WordPress contains a Server‑Side Request Forgery flaw (CWE‑918) in the load_previous_field_value() method of class‑evf‑form‑task.php. The method accepts an arbitrary URL value from the upload field without validating its domain and forwards it to wp_remote_head() in class‑evf‑form‑fields‑upload.php. This allows an unauthenticated user to submit a form with a malicious URL and a missing required field; when the form is re‑rendered the plugin causes the WordPress server to perform an outbound HTTP HEAD request to the attacker‑supplied URL. The result is that an attacker can force the server to reach arbitrary external hosts, potentially exposing internal services or exfiltrating data.

WordPress sites that have the Everest Forms plugin version 3.4.4 or earlier are affected. Any installation that has not upgraded beyond this release and still contains the plugin is susceptible to the SSRF vulnerability.

The CVSS score of 5.3 indicates medium severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated; any user able to submit the form can trigger the flaw by sending a crafted POST request with a malicious upload field value and leaving a required field empty. The flaw requires no privileged access or interaction beyond form submission, so exploitation can be performed from a remote location that can reach the affected site.