CVE-2026-3478 | THREATINT

Description

The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJAX action in the bundled ReduxFramework library. The plugin registers a proxy endpoint (wp_ajax_nopriv_redux_p) that is accessible to unauthenticated users. The proxy() method in the Redux_P class takes a URL directly from $_GET[‘url’] without any validation (the regex is set to /.*/ which matches all URLs) and passes it to wp_remote_request(), which does not have built-in SSRF protection like wp_safe_remote_request(). There is no authentication check, no nonce verification, and no URL restriction. The response from the requested URL is then returned to the attacker, making this a full-read SSRF. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal network ports, or interact with cloud metadata endpoints.

PUBLISHED Reserved 2026-03-03 | Published 2026-03-21 | Updated 2026-03-21 | Assigner Wordfence

HIGH: 7.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Problem types

CWE-918 Server-Side Request Forgery (SSRF)

Product status

Default status
unaffected

* (semver)
affected

Timeline

Credits

Youcef Hamdani finder

References

www.wordfence.com/…-d991-4638-ab4d-3b8697acf414?source=cve

plugins.trac.wordpress.org/…work/ReduxCore/inc/class.p.php

plugins.trac.wordpress.org/…work/ReduxCore/inc/class.p.php

plugins.trac.wordpress.org/…work/ReduxCore/inc/class.p.php

plugins.trac.wordpress.org/…work/ReduxCore/inc/class.p.php

plugins.trac.wordpress.org/…work/ReduxCore/inc/class.p.php

plugins.trac.wordpress.org/…work/ReduxCore/inc/class.p.php

cve.org (CVE-2026-3478)

nvd.nist.gov (CVE-2026-3478)

Download JSON