5.9Medium

CVE-2022-3590WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding

WordPress WordPress Published: 2022-12-14 11:33 (3 years ago)

Description

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

Weakness (CWE): CWE-918 CWE-367

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
WordPress	WordPress	4.1.30 – ≤ 6.1.1

References and patches

https://wpscan.com/vulnerability/c8814e6e-78b3-4f63-a1d3-6906a84c1f11 exploitvdb-entrytechnical-description
https://blog.sonarsource.com/wordpress-core-unauthenticated-blind-ssrf/

CVSS score

5.9Medium

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (chance of exploitation in 30 days)

3.43%

higher than 89% of all CVEs

CISA assessment (SSVC)

Exploitation: poc
Automatable: no
Technical impact: partial

Timeline

ID reserved2022-10-18
Published2022-12-14 11:33
Reached IP-DB2026-10-24 23:38
Last updated2025-04-21 17:12

Assigned by (CNA): WPScan

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress (core)

8.1High

CVE-2026-119977 KEV 11 days ago

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

WordPress Foundation WordPress

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the s…

1.2%EPSS

4.9Medium

CVE-2026-114570 20 days ago

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

WordPress Foundation WordPress

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and ab…

8.1High

CVE-2026-87902 KEV 1 month ago

WordPress Core Remote File Inclusion Vulnerability

WordPress WordPress

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

96%EPSS

8.8High

CVE-2026-65640 2 months ago

WordPress WordPress

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This…

1.9%EPSS

8.9High

CVE-2026-64638 3 months ago

WordPress WordPress

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of t…

5.9Medium

CVE-2026-60137 KEV 3 months ago

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

WordPress WordPress

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

5.3%EPSS