PT-2022-13847 · WordPress · Fusion Builder

Calum Elrick · Published 2022-05-16 · Updated 2024-03-14 · CVE-2022-1386

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fusion Builder WordPress plugin versions prior to 3.6.2

Description The issue concerns a lack of validation for a parameter in the plugin's forms, allowing for arbitrary HTTP requests. The returned data is reflected back in the application's response, potentially enabling interaction with hosts on the server's local network and bypassing firewalls and access control measures.

Recommendations For Fusion Builder WordPress plugin versions prior to 3.6.2, update to version 3.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's forms to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-1386

Affected Products

Fusion Builder

References · 9

• 🔥 https://github.com/ardzz/CVE-2022-1386 · Exploit
• 🔥 https://github.com/im-hanzou/fubucker · Exploit
• 🔥 https://wpscan.com/vulnerability/bf7034ab-24c4-461f-a709-3f73988b536b · Exploit
• https://rootshellsecurity.net/rootshell-discovered-a-critical-vulnerability-in-top-wordpress-theme · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-1386 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1386 · Vendor Advisory
• https://theme-fusion.com/version-7-6-2-security-update · Patch
• https://t.me/cvenotify/73838 · Telegram Post
• https://t.me/cvenotify/30642 · Telegram Post