PT-2022-23007 · WordPress+1 · Wordpress+1

Thomas Chauchefoin · Published 2022-12-14 · Updated 2026-02-19 · CVE-2022-3590

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 6.1 WordPress versions 6.1 through 6.2 WordPress versions 6.1 through 6.9.1

Description WordPress is susceptible to an unauthenticated blind Server-Side Request Forgery (SSRF) issue within the pingback feature. This is due to a Time-of-Check-to-Time-of-Use (TOCTOU) race condition occurring between the validation checks and the HTTP request. This allows attackers to access internal hosts that are explicitly prohibited. Exploitation can involve DNS rebinding. Potential impacts include internal reconnaissance and port scanning on ports such as 80, 443, and 8080, and access to cloud metadata if DNS redirects to addresses like 169.254.169.254. Remote Code Execution (RCE) is unlikely without chaining this issue with other internal vulnerabilities. The /xmlrpc.php endpoint is involved in this issue. The pingback feature is the source of the problem.

Recommendations For WordPress versions prior to 6.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For WordPress versions 6.1 through 6.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For WordPress versions 6.1 through 6.9.1, disable XML-RPC via plugin or .htaccess. As an alternative, uncheck "Allow link notifications from other blogs (pingbacks and trackbacks) on new posts" in the Discussion Settings to disable pingbacks.

Exploit

RCE

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BIT-WORDPRESS-2022-3590

BIT-WORDPRESS-MULTISITE-2022-3590

CVE-2022-3590

Affected Products

Debian

Wordpress

References · 22

• 🔥 https://github.com/hxlxmjxbbxs/CVE-2022-3590-WordPress-Vulnerability-Scanner · Exploit
• 🔥 https://github.com/hxlxmj/CVE-2022-3590-WordPress-Vulnerability-Scanner · Exploit
• 🔥 https://wpscan.com/vulnerability/c8814e6e-78b3-4f63-a1d3-6906a84c1f11 · Exploit
• 🔥 https://blog.sonarsource.com/wordpress-core-unauthenticated-blind-ssrf · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-3590 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3590 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-3590 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3590 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3590 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-2022-3590 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-wordpress-multisite-2022-3590 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-3590 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3590 · Vendor Advisory
• https://t.me/cibsecurity/54496 · Telegram Post
• https://t.me/cvenotify/119162 · Telegram Post