CVE-2026-3712

7.3High

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.3High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-918

Impact

Unauthenticated remote attackers can trigger server-side request forgery to access internal network services and read their responses. They only need network access to the site to spoof the HTTP Host header.

Root cause

The scripts service endpoint dynamically generates its URL whitelist directly from the user-controlled HTTP 'Host' request header.

Affected systems

PhastPress plugin for WordPress versions up to and including 3.10

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Fix & remediation

Upgrade the PhastPress plugin to version 3.11 or later. If patching immediately is not possible, deactivate the PhastPress plugin.

shell

$ wp plugin update phastpress

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-3712