Main Vulnerability Database Vulnerabilities #VU70526

Server-Side Request Forgery (SSRF) in WordPress - CVE-2022-3590

Published: December 28, 2022 / Updated: June 14, 2023

Vulnerability identifier: #VU70526

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2022-3590

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input within the pingback functionality. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Affected software

WordPress

How to mitigate CVE-2022-3590

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Links to Public Exploits and PoC-codes

Exploit #9105 - CVE-2022-3590-WordPress-Vulnerability-Scanner ( This repository contains a Python script that checks WordPress websites for the CVE-2022-3590 vulnerability, which exploits an unauthenticated blind Server-Side Request Forgery (SSRF) in the WordPress pingba (June 14, 2023)

External References

Related Security Bulletins

SSRF in WordPress