CVE-2022-3590: WordPress

Medium severity, CVSS 5.9. EPSS: 3.2% chance of exploitation in the next 30 days.

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

Affected products

• WordPress WordPress: from 4.2, up to and including 6.1.1; version 4.1 only

Published 2022-12-14. Last modified 2026-06-17.