vulnerability

WordPress Plugin: web-stories: CVE-2022-3708: Server-Side Request Forgery (SSRF)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:S/C:C/I:C/A:N)

Published

Oct 26, 2022

Added

May 15, 2025

Modified

May 5, 2026

Description

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Solution

web-stories-plugin-cve-2022-3708

References

https://www.cve.org/CVERecord?id=CVE-2022-3708
https://www.wordfence.com/threat-intel/vulnerabilities/id/7817a840-325a-4709-8374-84bb32d98d0e?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43065
CVE-2022-3708
https://attackerkb.com/topics/CVE-2022-3708
CWE-918
EUVD-EUVD-2022-43065

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report