Unauthenticated Blind SSRF in WordPress Pingback Feature
Summary
CVE-2022-3590: WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Affects wordpress across 4 version ranges.
>= 7b07c0ccc7453ce057e009ffa65f12a02ce7d2ee, <= 031cedc06d612c4a74f7b6d3e77d8145f2954a25
>= 87bf150016e042bc3e21f2f1cb9de44042b8cdb1, <= c927cb503affd9182a6d4d39f0cadf4e10523cda
< 470529c2bf211450e91f01ceadaa9fc97a2b4031
< e5e791f331d371ad6262c1893d84f5f2b6c26464
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WordPress is a widely-used open-source content management system (CMS) that allows users to create and manage websites easily. It offers a variety of features, including themes, plugins, and a robust community. However, like any software, it is not immune to vulnerabilities. The specific vulnerability in question affects the pingback feature, which is used to notify other blogs when a post is linked to them. This feature, while useful, can be exploited if not properly secured.
Vulnerability Detail
The vulnerability identified as CVE-2022-3590 is an unauthenticated blind Server-Side Request Forgery (SSRF) that arises from a Time-of-Check to Time-of-Use (TOCTOU) race condition between validation checks and the subsequent HTTP request. This flaw allows attackers to bypass restrictions and access internal hosts that should be off-limits. The implications of this vulnerability can be severe, as it may lead to unauthorized access to sensitive internal services and data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the pingback feature in WordPress settings to prevent exploitation until an update can be applied. This can be done by navigating to the 'Settings' menu, selecting 'Discussion', and unchecking the option for 'Allow link notifications from other blogs (pingbacks and trackbacks)'.
Conclusion
CVE-2022-3590 represents a significant security risk for WordPress users, particularly those utilizing the pingback feature. It is crucial to stay updated with the latest security patches and consider disabling vulnerable features until a fix is applied. Regular monitoring for vulnerabilities using tools like Vulert can enhance security posture.
See every vulnerability recorded for wordpress →
FAQ
CVE-2022-3590 is a vulnerability in WordPress that allows unauthenticated attackers to exploit the pingback feature to perform Server-Side Request Forgery (SSRF) attacks.
If you are using an outdated version of WordPress that has not been patched, your site may be vulnerable. You can check your version in the WordPress admin dashboard.
The main risk is unauthorized access to internal services, which could lead to data breaches or further exploitation of the server.
Yes, you can use tools like Vulert, which monitors open-source vulnerabilities in your software by analyzing your manifest file, such as package-lock.json.
The CVSS score for CVE-2022-3590 is 5.9, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for wordpress.
