Server-Side Request Forgery in Web Stories Plugin for WordPress by Google

CVE-2022-3708

What is CVE-2022-3708?

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in all versions up to and including 1.24.0. This vulnerability arises from inadequate validation of the URLs provided via the 'url' parameter in the /v1/hotlink/proxy REST API Endpoint. Authenticated users can exploit this flaw to initiate requests to arbitrary locations. As a result, attackers may gain access to sensitive information or manipulate data from internal services, significantly compromising the security posture of WordPress sites leveraging this plugin.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References