medium5.9
CVE-2022-3590
WordPress is affected by an unauthenticated blind SSRF in the pingback feature.
Impact
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wordpress | Wordpress | from 4.2 through 6.1.1 Version 4.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://blog.sonarsource.com/wordpress-core-unauthenticated-blind-ssrf/
- https://wpscan.com/vulnerability/c8814e6e-78b3-4f63-a1d3-6906a84c1f11
- https://blog.sonarsource.com/wordpress-core-unauthenticated-blind-ssrf/
- https://wpscan.com/vulnerability/c8814e6e-78b3-4f63-a1d3-6906a84c1f11