PT-2026-26856 · Benmoody · Content Syndication Toolkit

Youcef Hamdani

·

Published

2026-03-21

·

Updated

2026-03-21

·

CVE-2026-3478

CVSS v3.1

7.2

High

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux p AJAX action in the bundled ReduxFramework library. The plugin registers a proxy endpoint (wp ajax nopriv redux p) that is accessible to unauthenticated users. The proxy() method in the Redux P class takes a URL directly from $ GET['url'] without any validation (the regex is set to /.*/ which matches all URLs) and passes it to wp remote request(), which does not have built-in SSRF protection like wp safe remote request(). There is no authentication check, no nonce verification, and no URL restriction. The response from the requested URL is then returned to the attacker, making this a full-read SSRF. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal network ports, or interact with cloud metadata endpoints.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-3478

Affected Products

Content Syndication Toolkit