CVE-2022-1386: Fusion Builder < 3.6.2 - Unauthenticated SSRF
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-1386?
CVE-2022-1386 has a high severity due to the potential for arbitrary HTTP requests and reflected data in responses.
How do I fix CVE-2022-1386?
To fix CVE-2022-1386, update the Fusion Builder WordPress plugin to version 3.6.2 or later.
What are the potential impacts of CVE-2022-1386?
CVE-2022-1386 could allow attackers to execute arbitrary HTTP requests, leading to possible data exposure or manipulation.
Which WordPress plugins are affected by CVE-2022-1386?
CVE-2022-1386 affects the Fusion Builder plugin and the Avada theme prior to version 3.6.2.
Is my site vulnerable to CVE-2022-1386?
If you are using Fusion Builder or the Avada theme before version 3.6.2, your site is vulnerable to CVE-2022-1386.