Description
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WordPress | WordPress | 4.1.30 – ≤ 6.1.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | No fix yet | — |
| Debian 13 | wordpress | No fix yet | — |
| Debian 12 | wordpress | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | wordpress | No fix yet | — |
| Ubuntu 26.04 LTS | wordpress | No fix yet | — |
| Ubuntu 25.10 | wordpress | No fix yet | — |
| Ubuntu 24.04 LTS | wordpress | No fix yet | — |
| Ubuntu 22.04 LTS | wordpress | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | wordpress | No fix yet | — |
| Ubuntu 18.04 LTS | wordpress | No fix yet | — |
| Ubuntu 16.04 LTS | wordpress | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
hxlxmj/CVE-2022-3590-WordPress-Vulnerability-Scanner ★ 7 · Jun 12, 2023
This repository contains a Python script that checks WordPress websites for the CVE-2022-3590 vulnerability, which exploits an unauthenticated blind Server-Side Request Forgery (SSRF) in the WordPres…
-
TJouleL/WordPress-6.9.1-Blind-SSRF ★ 0 · Apr 22, 2026
Based on CVE-2022-3590, WordPress <= 6.9.1 - Unauthenticated Blind SSRF via XML-RPC Pingback Discovery proof of concept (PoC)
-
huynhvanphuc/CVE-2022-3590-WordPress-Vulnerability-Scanner ★ 0 · Aug 8, 2024
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress <= 6.2 - Server Side Request Forgery http/cves/2022/CVE-2022-3590.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- WID-SEC-2022-2356 WordPress: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Dec 18, 2022
References
- https://wpscan.com/vulnerability/c8814e6e-78b3-4f63-a1d3-6906a84c1f11 exploit vdb-entry technical-description
- https://blog.sonarsource.com/wordpress-core-unauthenticated-blind-ssrf/