Everest Forms Vulnerability- Unauthenticated Server-Side Request Forgery via font_url – CVE-2024-1812 | WordPress Plugin Vulnerability Report

Plugin Name: Everest Forms – Build Contact Forms, Surveys, Polls, Quizzes, Newsletter & Application Forms, and Many More with Ease!

Key Information:

  • Software Type: Plugin
  • Software Slug: everest-forms
  • Software Status: Active
  • Software Author: wpeverest
  • Software Downloads: 5,605,349
  • Active Installs: 100,000
  • Last Updated: March 19, 2024
  • Patched Versions: 2.0.8
  • Affected Versions: <= 2.0.7

Vulnerability Details:

  • Name: Everest Forms <= 2.0.7
  • Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1812
  • CVSS Score: 7.2
  • Publicly Published: March 15, 2024
  • Researcher: hir0ot
  • Description: The Everest Forms plugin for WordPress is susceptible to a Server-Side Request Forgery vulnerability in all versions up to and including 2.0.7 via the 'font_url' parameter. This flaw allows unauthenticated attackers to initiate web requests from the application to arbitrary locations, potentially querying and modifying data from internal services.


The Everest Forms plugin for WordPress harbors a vulnerability in versions up to and including 2.0.7 that enables unauthenticated Server-Side Request Forgery via the 'font_url' parameter. This vulnerability has been rectified in version 2.0.8.

Detailed Overview:

The vulnerability was identified by the researcher hir0ot and exists due to improper validation of the 'font_url' parameter within the Everest Forms plugin. This weakness allows attackers to send crafted web requests from the server, potentially accessing and manipulating internal network resources. The risks associated with this vulnerability include unauthorized access to sensitive information and potential manipulation of internal systems without authentication.

Advice for Users:

  • Immediate Action: Users are strongly encouraged to update Everest Forms to version 2.0.8 immediately.
  • Check for Signs of Vulnerability: Review server logs for any unusual web requests or activity that may indicate exploitation.
  • Alternate Plugins: While the patch is available, considering alternative form plugins may serve as a precautionary measure.
  • Stay Updated: Regularly updating all WordPress plugins to their latest versions is crucial to maintaining security and preventing vulnerabilities.


The swift action by the developers of Everest Forms to release a patch for this vulnerability highlights the importance of regular software updates. To safeguard WordPress sites, users must ensure they are running version 2.0.8 or later of the Everest Forms plugin.


Detailed Report: 

In the fast-paced digital age, the security of your online presence is paramount, especially for small business owners who juggle numerous responsibilities daily. The recent discovery of a significant vulnerability within the Everest Forms plugin for WordPress highlights the critical need for vigilance and the importance of keeping your website's components up-to-date. Let's delve into the specifics of this issue and outline steps to ensure your website remains secure, without overwhelming your already packed schedule.

Everest Forms Plugin: A Cornerstone of WordPress Functionality

Everest Forms is a widely acclaimed plugin, empowering WordPress users to effortlessly create various forms such as contact forms, surveys, and newsletters. With over 5,605,349 downloads and 100,000 active installations, its impact and utility in the WordPress ecosystem are undeniable. Maintained by wpeverest, the plugin's popularity underscores its utility across a broad spectrum of websites.

The Vulnerability: A Gateway for Unwanted Intruders

The vulnerability in question, cataloged as CVE-2024-1812, pertains to versions of Everest Forms up to and including 2.0.7. It involves an unauthenticated Server-Side Request Forgery (SSRF) via the 'font_url' parameter, allowing attackers to send requests from your website to any location on the internet. This can lead to unauthorized access to internal systems and sensitive information. The CVSS score of 7.2 signifies its high severity, with the flaw publicly disclosed on March 15, 2024, by a researcher known as hir0ot.

Risks and Potential Impacts

The exploitation of this vulnerability could have dire consequences, including the leakage of confidential data, unauthorized manipulation of website content, and potentially even a complete takeover of the website. For a small business, such breaches can result in financial loss, erosion of customer trust, and significant reputational damage.

Remediation: Securing Your Digital Front

Thankfully, the developers of Everest Forms acted swiftly to address this issue, releasing a patched version 2.0.8. The immediate step for website owners is to update the Everest Forms plugin to this latest version. Additionally, regularly reviewing server logs for unusual activity and considering alternate plugins as a precaution can further bolster your website's defenses.

Previous Vulnerabilities: A Pattern of Alerts

It's worth noting that this is not the first vulnerability discovered in Everest Forms; there have been four others since July 2019. This pattern serves as a reminder of the ever-present nature of security threats in the digital world and the need for continuous monitoring and updates.

The Bottom Line for Busy Entrepreneurs

For small business owners, the prospect of constantly monitoring for such vulnerabilities may seem daunting. However, the reality is that the security of your digital assets is too critical to overlook. Implementing a routine schedule for checking and updating your website's plugins and themes can mitigate the risk of security breaches. Moreover, leveraging managed WordPress hosting services or engaging with cybersecurity professionals can provide peace of mind, allowing you to focus on your business while experts handle the technicalities of website security.

In conclusion, while the digital landscape offers boundless opportunities for growth and engagement, it also presents numerous security challenges. Staying informed, proactive, and prepared is essential. By taking the steps outlined above and considering professional assistance for website maintenance, small business owners can secure their online presence against the evolving threats of the digital world.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Everest Forms Vulnerability- Unauthenticated Server-Side Request Forgery via font_url – CVE-2024-1812 | WordPress Plugin Vulnerability Report FAQs

What is CVE-2024-1812?

CVE-2024-1812 refers to a security vulnerability identified in the Everest Forms plugin for WordPress. This flaw is classified as an unauthenticated Server-Side Request Forgery (SSRF) issue, which allows attackers to send web requests from the affected site to any location on the internet, potentially leading to unauthorized access and manipulation of internal systems.

The vulnerability is significant due to the wide usage of Everest Forms, impacting numerous websites. It underscores the importance of maintaining updated software to safeguard against potential security threats.

Leave a Comment