CVE-2026-3712 PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter
Unauthenticated attackers can force the server to make arbitrary HTTP requests and read responses by spoofing the Host header to bypass URL whitelists.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3712?
CVE-2026-3712 is a high-severity server-side request forgery vulnerability in kiboit PhastPress, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.
Weakness: CWE-918
Which versions are affected by CVE-2026-3712?
How do I fix CVE-2026-3712?
No fix has been published for CVE-2026-3712 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-3712 being exploited?
There is no known exploitation of CVE-2026-3712 in the wild and no public exploit code.
Sources
Also known as GHSA-gj56-mwgx-mqvf.