Server-Side Request Forgery Vulnerability in Frontis Blocks Plugin for WordPress

CVE-2026-0807

What is CVE-2026-0807?

The Frontis Blocks plugin for WordPress is affected by a Server-Side Request Forgery (SSRF) vulnerability, present in all versions up to and including 1.1.6. This vulnerability arises from inadequate validation on the 'url' parameter within the 'template_proxy' function. As a consequence, unauthenticated attackers can exploit this flaw to initiate web requests to arbitrary locations, taking advantage of the plugin's endpoints like '/template-proxy/' and '/proxy-image/'. This can lead to unauthorized actions from the web application, posing security risks to users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References