Server-Side Request Forgery in PhastPress Plugin for WordPress

CVE-2026-3712

What is CVE-2026-3712?

The PhastPress plugin for WordPress is susceptible to a server-side request forgery (SSRF) vulnerability present in all versions up to and including 3.10. This issue arises from the dynamic construction of the URL whitelist within the script's service endpoint, which relies on the user-supplied HTTP 'Host' header. Malicious actors can exploit this weakness by manipulating the 'Host' header to match any desired URL, thereby bypassing the server's security mechanisms. This allows unauthorized entities to trick the server into making HTTP requests to any internal or external destination, potentially exposing sensitive information or enabling further attacks.

References