{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/phastpress--3.10/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:phastpress:phastpress:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-3712"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PhastPress (\u003c= 3.10)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","ssrf","wordpress"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe PhastPress plugin for WordPress (versions 3.10 and earlier) contains a critical Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-3712. The flaw exists within the plugin's scripts service endpoint, which fails to securely validate user input when constructing its URL whitelist. Specifically, the service dynamically pulls values from the 'Host' header provided in incoming HTTP requests. Because this header is attacker-controlled, an unauthenticated actor can spoof the 'Host' header to match legitimate whitelist patterns, effectively bypassing security controls. Once bypassed, the plugin forces the underlying WordPress server to perform HTTP requests to arbitrary destinations, including internal network resources and external services. This can lead to unauthorized data access, network reconnaissance, or potential interaction with sensitive internal APIs that are otherwise inaccessible from the public internet.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to force the web server to make arbitrary requests, potentially exposing internal-only services or exfiltrating sensitive content returned by the target endpoints. This represents a significant risk to organizations hosting internal APIs or restricted microservices within the same network as the vulnerable WordPress installation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the PhastPress plugin to the latest version immediately to remediate CVE-2026-3712. If patching is not immediately feasible, monitor web server logs for suspicious HTTP requests involving the PhastPress scripts service endpoint, particularly those where the Host header does not match expected site traffic patterns.\u003c/p\u003e\n","date_modified":"2026-10-15T06:35:26Z","date_published":"2026-10-15T06:35:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-phastpress-ssrf/","summary":"The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery via insecure Host header processing, allowing unauthenticated attackers to bypass URL allowlists and perform unauthorized requests.","title":"PhastPress Plugin for WordPress SSRF Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-10-phastpress-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - PhastPress (\u003c= 3.10)","version":"https://jsonfeed.org/version/1.1"}