CVE-2022-3590
No fix known EPSS 3%CVSS 5.9
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
Products: WordPress
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | wordpress | no fix |
| Debian:13 | wordpress | no fix |
| Debian:14 | wordpress | no fix |
| Ubuntu:16.04:LTS | wordpress | no fix |
| Ubuntu:18.04:LTS | wordpress | no fix |
| Ubuntu:20.04:LTS | wordpress | no fix |
| Ubuntu:22.04:LTS | wordpress | no fix |
| Ubuntu:24.04:LTS | wordpress | no fix |
| Ubuntu:25.10 | wordpress | no fix |
| Ubuntu:26.04:LTS | wordpress | no fix |
| Ubuntu:26.10 | wordpress | no fix |