CVE-2026-3712
PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter
CVSS Score
7.3
EPSS Score
0.0%
EPSS Percentile
0th
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.
| CWE | CWE-918 |
| Vendor | kiboit |
| Product | phastpress |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for kiboit phastpress
Be the first to know when new high vulnerabilities affecting kiboit phastpress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
kiboit / PhastPress
0 ≤ 3.10
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/1c3fbca2-f11f-4f9c-9d70-eea98bdfd3b0?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?reponame=&new=3627042%40phastpress%2Ftags%2F3.11&old=3578731%40phastpress%2Ftags%2F3.10 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3627041/phastpress/trunk/sdk/phast.php
Credits
Itthidej Aramsri (Boeing777)