← Database

CVE-2022-3590

MEDIUM CVSS: 5.9 Published: 2022-12-14 Modified: 2026-06-17

Description

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

Affected Platforms

Wordpress Wordpress

Weakness Type

CWE-367

References