Security Flaws in Stape Conversion Tracking Plugin Affecting WordPress Sites
CVE-2026-118422

Currently unrated

Key Information:

Vendor

WordPress
Status
Stape Conversion Tracking
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-118422?

The Stape Conversion Tracking WordPress plugin prior to version 2.3.11 lacks proper validation for the sub-path appended to its same-origin proxy's upstream endpoint. This oversight enables unauthorized users to redirect server-side requests to arbitrary hosts. Consequently, the response body along with its original content type is returned with stripped security headers from the site's own origin, exposing the site to potential Server-Side Request Forgery attacks, inclusive of loopback and internal host requests, as well as vulnerabilities related to Cross-Site Scripting.

Affected Version(s)

Stape Conversion Tracking 2.3.0 < 2.3.11

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-118422 - Proof of Concept

References

https://wpscan.com/vulnerability/e41ab896-23b8-40b3-8e3f-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joep van Antwerpen
WPScan
.