vulnerability

Wordpress: CVE-2022-3590: Server-Side Request Forgery (SSRF)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:C/I:N/A:N)

Published

Dec 14, 2022

Added

Jan 23, 2023

Modified

Mar 30, 2026

Description

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

Solution

wordpress-upgrade-6_1_2

References

CVE-2022-3590
https://attackerkb.com/topics/CVE-2022-3590
CWE-367
EUVD-EUVD-2022-42954
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42954

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report