CVE-2026-3712: PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it. No WordPress account or other privileges are required.
What does an attacker need to control to bypass the URL whitelist?
The attacker needs to send a request to the scripts service endpoint with a spoofed HTTP Host header. The endpoint dynamically builds its whitelist from that attacker-controlled header, allowing the attacker to make it match an arbitrary target URL.
What could exploitation allow an attacker to do?
The attacker can force the WordPress server to issue HTTP requests to arbitrary internal or external destinations. The endpoint returns the response content, which may expose data reachable from the server.
Which versions are affected?
PhastPress versions up to and including 3.10 are affected. The referenced plugin changes indicate that version 3.11 contains relevant changes.