CVE-2022-0591 - Formcraft3 < 3.8.28 - Unauthenticated SSRF

Back Back to CVE browser

CRITICAL

Formcraft3 < 3.8.28 - Unauthenticated SSRF

Published Mar 21, 2022

9.1

CRITICAL

CVSS 3.1

EPSS 20.25%

Description

The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users

Affected products

Vendor n/a Product FormCraft Default
n/a
- Version
  3.8.28
  Status
  affected
  Constraints
  <3.8.28

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

FormCraft

n/a

Version	Status	Constraints
3.8.28	affected	<3.8.28

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (1)

https://wpscan.com/vulnerability/b5303e63-d640-4178-9237-d0f524b13d47
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/b5303e63-d640-4178-9237-d0f524b13d47		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Mar 21, 2022

Updated Aug 2, 2024

Reserved Feb 14, 2022

Link CVE-2022-0591

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-0591

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-0591