CVE-2024-1812 Everest Forms <= 2.0.7 - Unauthenticated Server-Side Request Forgery via font_url

What is CVE-2024-1812?

CVE-2024-1812 is a high-severity server-side request forgery vulnerability in wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder, published on 9 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'font_url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Weakness: CWE-918

Which versions are affected by CVE-2024-1812?

It affects 1 product.

Products include Wpeverest Everest Forms.

How do I fix CVE-2024-1812?

No fix has been published for CVE-2024-1812 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-1812 being exploited?

There is no known exploitation of CVE-2024-1812 in the wild and no public exploit code.

Other vulnerabilities in wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder

• CVE-2025-3439 Deserialization in Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Critical 9.8
• CVE-2025-1128 Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion Critical 9.8
• CVE-2019-13575 SQL injection in n/a Critical 9.8
• CVE-2025-5927 Everest Forms (Pro) <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion High 7.5
• CVE-2025-26841 Cross-site scripting in n/a Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g7vh-v2c6-r3fm.