PT-2026-4577 · WordPress · Frontis Blocks

Itthidej Aramsri + 1 · Publicado 2026-01-24 · Atualizado 2026-01-24 · CVE-2026-0807

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Frontis Blocks versions prior to 1.1.7

Description The Frontis Blocks plugin for WordPress is susceptible to Server-Side Request Forgery. This is caused by inadequate restriction of the url parameter within the template proxy function. This allows unauthenticated attackers to initiate web requests to arbitrary locations from the web application. The affected API endpoints are '/template-proxy/' and '/proxy-image/'.

Recommendations Update Frontis Blocks to version 1.1.7 or later.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-0807

Produtos afetados

Frontis Blocks

Referências · 8

• https://plugins.trac.wordpress.org/browser/frontis-blocks/tags/1.1.4/includes/Admin/Admin.php#L910 · Nota
• https://twitter.com/VulmonFeeds/status/2015014145414803488 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-0807 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/frontis-blocks/trunk/includes/Admin/Admin.php#L910 · Nota
• https://plugins.trac.wordpress.org/changeset/3444616 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/322e0a27-9119-4b46-a043-d3a68c4fcdc4?source=cve · Nota
• https://twitter.com/CVEnew/status/2014995792373923878 · Publicação no Twitter
• https://twitter.com/RedPacketSec/status/2015012984368595245 · Publicação no Twitter