p PatchFirst

CVE-2022-3590

CVE-2022-3590 · WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding

This page contains facts from public vulnerability sources. Check the original advisory before updating.

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

CVSS 5.9 · Medium · EPSS 3.4% · Public exploit

Published
Updated

Stack: system

Affected products and versions

  • wordpress

    Versions
    • ≥ 4.1.30, ≤ 6.1.1: Affected (custom)

    No fix published

  • wordpress Debian:12

    Versions
    • 6.1.1+dfsg1-1
    • 6.1.6+dfsg1-0+deb12u1
    • 6.1.9+dfsg1-0+deb12u1
    • 6.2+dfsg1-1
    • 6.2.1+dfsg1-1
    • 6.2.2+dfsg1-1
    • 6.3+dfsg1-1
    • 6.3.1+dfsg1-1
    • 6.3.2+dfsg1-1
    • 6.4.1+dfsg1-1
    • 6.4.1+dfsg1-1.1
    • 6.4.2+dfsg1-1
    • 6.4.3+dfsg1-1
    • 6.5+dfsg1-1
    • 6.5.2+dfsg1-1
    • 6.5.3+dfsg1-1
    • 6.5.5+dfsg1-1
    • 6.6.1+dfsg1-1
    • 6.7.2+dfsg1-1
    • 6.7.2+dfsg1-1.1
    • 6.8.1+dfsg1-1
    • 6.8.3+dfsg1-1
    • 6.9+dfsg1-1
    • 6.9.4+dfsg1-1
    • 7.0+dfsg1-1
    • 7.0.2+dfsg1-1
    • 7.0.3+dfsg1-1
    • 7.1+dfsg1-1
    • 7.1.1+dfsg1-1
    • 7.1.2+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Debian:13

    Versions
    • 6.8.1+dfsg1-1
    • 6.8.10+dfsg1-0+deb13u1
    • 6.8.3+dfsg1-0+deb13u1
    • 6.8.3+dfsg1-1
    • 6.8.6+dfsg1-0+deb13u1
    • 6.8.7+dfsg1-0+deb13u1
    • 6.9+dfsg1-1
    • 6.9.4+dfsg1-1
    • 7.0+dfsg1-1
    • 7.0.2+dfsg1-1
    • 7.0.3+dfsg1-1
    • 7.1+dfsg1-1
    • 7.1.1+dfsg1-1
    • 7.1.2+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Debian:14

    Versions
    • 6.8.1+dfsg1-1
    • 6.8.3+dfsg1-1
    • 6.9+dfsg1-1
    • 6.9.4+dfsg1-1
    • 7.0+dfsg1-1
    • 7.0.2+dfsg1-1
    • 7.0.3+dfsg1-1
    • 7.1+dfsg1-1
    • 7.1.1+dfsg1-1
    • 7.1.2+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Ubuntu:16.04:LTS

    Versions
    • 4.3+dfsg-1
    • 4.3.1+dfsg-1
    • 4.4+dfsg-1
    • 4.4.1+dfsg-1
    • 4.4.2+dfsg-1
    • 4.4.2+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Ubuntu:18.04:LTS

    Versions
    • 4.8.2+dfsg-2
    • 4.8.3+dfsg-1
    • 4.9.1+dfsg-1
    • 4.9.2+dfsg-1
    • 4.9.4+dfsg-1
    • 4.9.5+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Ubuntu:20.04:LTS

    Versions
    • 5.2.2+dfsg1-1
    • 5.2.4+dfsg1-1
    • 5.3.2+dfsg1-1
    • 5.3.2+dfsg1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Ubuntu:22.04:LTS

    Versions
    • 5.7.1+dfsg1-2ubuntu1
    • 5.8.1+dfsg1-2ubuntu1
    • 5.8.2+dfsg1-1ubuntu1
    • 5.8.3+dfsg1-1ubuntu1
    • 5.8.3+dfsg1-1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Ubuntu:24.04:LTS

    Versions
    • 6.2+dfsg1-1ubuntu1
    • 6.4.3+dfsg1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Ubuntu:25.10

    Versions
    • 6.7.2+dfsg1-1.1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Ubuntu:26.10

    Versions
    • 6.7.2+dfsg1-1.1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Ubuntu:26.04:LTS

    Versions
    • 6.7.2+dfsg1-1.1ubuntu1
    • 6.7.2+dfsg1-1.1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →