IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
5.9Orta

CVE-2022-3590WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding

WordPress WordPress Yayım: (3 yıl önce)

Açıklama

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

Zayıflık türü (CWE): CWE-918CWE-367

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
WordPress WordPress 4.1.30 – ≤ 6.1.1

Kaynaklar ve yamalar

Aynı üründe son açıklar — WordPress (core)

8.1Yüksek
CVE-2026-87902 KEV

WordPress Core Remote File Inclusion Vulnerability

WordPress WordPress

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

96%EPSS
8.8Yüksek
CVE-2026-65640
WordPress WordPress

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This…

1.9%EPSS
8.9Yüksek
CVE-2026-64638
WordPress WordPress

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of t…