CVE-2026-3478 (GCVE-0-2026-3478)

Vulnerability from cvelistv5 – Published: 2026-03-21 03:27 – Updated: 2026-03-23 15:52
VLAI?
Title
Content Syndication Toolkit <= 1.3 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
Summary
The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJAX action in the bundled ReduxFramework library. The plugin registers a proxy endpoint (wp_ajax_nopriv_redux_p) that is accessible to unauthenticated users. The proxy() method in the Redux_P class takes a URL directly from $_GET['url'] without any validation (the regex is set to /.*/ which matches all URLs) and passes it to wp_remote_request(), which does not have built-in SSRF protection like wp_safe_remote_request(). There is no authentication check, no nonce verification, and no URL restriction. The response from the requested URL is then returned to the attacker, making this a full-read SSRF. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal network ports, or interact with cloud metadata endpoints.
Severity ?
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
Vendor Product Version
benmoody Content Syndication Toolkit Affected: * , ≤ 1.3 (semver)
Create a notification for this product.
Credits
Youcef Hamdani
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3478",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-23T15:52:22.112673Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-23T15:52:31.742Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Content Syndication Toolkit",
          "vendor": "benmoody",
          "versions": [
            {
              "lessThanOrEqual": "1.3",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Youcef Hamdani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJAX action in the bundled ReduxFramework library. The plugin registers a proxy endpoint (wp_ajax_nopriv_redux_p) that is accessible to unauthenticated users. The proxy() method in the Redux_P class takes a URL directly from $_GET[\u0027url\u0027] without any validation (the regex is set to /.*/ which matches all URLs) and passes it to wp_remote_request(), which does not have built-in SSRF protection like wp_safe_remote_request(). There is no authentication check, no nonce verification, and no URL restriction. The response from the requested URL is then returned to the attacker, making this a full-read SSRF. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal network ports, or interact with cloud metadata endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-21T03:27:13.132Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f8381866-d991-4638-ab4d-3b8697acf414?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L219"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L219"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L161"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L161"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L7"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L7"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-20T15:09:53.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Content Syndication Toolkit \u003c= 1.3 - Unauthenticated Server-Side Request Forgery via \u0027url\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-3478",
    "datePublished": "2026-03-21T03:27:13.132Z",
    "dateReserved": "2026-03-03T13:53:57.074Z",
    "dateUpdated": "2026-03-23T15:52:31.742Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-3478\",\"sourceIdentifier\":\"security@wordfence.com\",\"published\":\"2026-03-21T04:17:25.807\",\"lastModified\":\"2026-03-23T14:32:02.800\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJAX action in the bundled ReduxFramework library. The plugin registers a proxy endpoint (wp_ajax_nopriv_redux_p) that is accessible to unauthenticated users. The proxy() method in the Redux_P class takes a URL directly from $_GET[\u0027url\u0027] without any validation (the regex is set to /.*/ which matches all URLs) and passes it to wp_remote_request(), which does not have built-in SSRF protection like wp_safe_remote_request(). There is no authentication check, no nonce verification, and no URL restriction. The response from the requested URL is then returned to the attacker, making this a full-read SSRF. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal network ports, or interact with cloud metadata endpoints.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@wordfence.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security@wordfence.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]}],\"references\":[{\"url\":\"https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L161\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L219\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L7\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L161\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L219\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L7\",\"source\":\"security@wordfence.com\"},{\"url\":\"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8381866-d991-4638-ab4d-3b8697acf414?source=cve\",\"source\":\"security@wordfence.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-03-21T03:27:13.132Z\"}, \"affected\": [{\"vendor\": \"benmoody\", \"product\": \"Content Syndication Toolkit\", \"versions\": [{\"version\": \"*\", \"status\": \"affected\", \"lessThanOrEqual\": \"1.3\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJAX action in the bundled ReduxFramework library. The plugin registers a proxy endpoint (wp_ajax_nopriv_redux_p) that is accessible to unauthenticated users. The proxy() method in the Redux_P class takes a URL directly from $_GET[\u0027url\u0027] without any validation (the regex is set to /.*/ which matches all URLs) and passes it to wp_remote_request(), which does not have built-in SSRF protection like wp_safe_remote_request(). There is no authentication check, no nonce verification, and no URL restriction. The response from the requested URL is then returned to the attacker, making this a full-read SSRF. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal network ports, or interact with cloud metadata endpoints.\"}], \"title\": \"Content Syndication Toolkit \u003c= 1.3 - Unauthenticated Server-Side Request Forgery via \u0027url\u0027 Parameter\", \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8381866-d991-4638-ab4d-3b8697acf414?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L219\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L219\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L161\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L161\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/trunk/inc/ReduxFramework/ReduxCore/inc/class.p.php#L7\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/content-syndication-toolkit/tags/1.3/inc/ReduxFramework/ReduxCore/inc/class.p.php#L7\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-918 Server-Side Request Forgery (SSRF)\", \"cweId\": \"CWE-918\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\"}}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Youcef Hamdani\"}], \"timeline\": [{\"time\": \"2026-03-20T15:09:53.000Z\", \"lang\": \"en\", \"value\": \"Disclosed\"}]}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-3478\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-23T15:52:22.112673Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-23T15:52:26.812Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-3478\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Wordfence\", \"dateReserved\": \"2026-03-03T13:53:57.074Z\", \"datePublished\": \"2026-03-21T03:27:13.132Z\", \"dateUpdated\": \"2026-03-23T15:52:31.742Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.