PT-2026-26856 · WordPress · Wordpress Content Syndication Toolkit

Youcef Hamdani · Published 2026-03-21 · Updated 2026-03-22 · CVE-2026-3478

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Content Syndication Toolkit plugin versions prior to 1.4

Description The WordPress Content Syndication Toolkit plugin is susceptible to a Server-Side Request Forgery issue. The plugin registers an unauthenticated proxy endpoint, ''wp ajax nopriv redux p'', which accepts a URL from the url GET parameter without validation. This parameter is passed to wp remote request(), lacking built-in SSRF protection. The absence of authentication checks, nonce verification, and URL restrictions allows attackers to make web requests to arbitrary locations from the web application, potentially enabling access to internal services, network scanning, and interaction with cloud metadata endpoints.

Recommendations Update to version 1.4 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-3478

Affected Products

Wordpress Content Syndication Toolkit

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-3478 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f8381866-d991-4638-ab4d-3b8697acf414?source=cve · Note
• https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L7 · Note
• https://twitter.com/CVEnew/status/2035237228591652888 · Twitter Post
• https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L219 · Note
• https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L219 · Note
• https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L7 · Note
• https://twitter.com/RedPacketSec/status/2035519487575801915 · Twitter Post
• https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L161 · Note
• https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L161 · Note
• https://twitter.com/VulmonFeeds/status/2035297188561965061 · Twitter Post