---
id: CVE-2026-3712
title: >-
  The PhastPress plugin for WordPress is vulnerable to Server-Side Request
  Forgery in all versions up to, and including, 3.10 This is due to the scripts
  service endpoint constructing its URL whitelist dynamically from the
  attacker-controll…
summary: >-
  The PhastPress plugin for WordPress is vulnerable to Server-Side Request
  Forgery in all versions up to, and including, 3.10 This is due to the scripts
  service endpoint constructing its URL whitelist dynamically from the
  attacker-controll…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-918
vendor: kiboit
product: PhastPress
affected:
  - PhastPress <= 3.10
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T05:17:04.067'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-3712'
references:
  - url: >-
      https://plugins.trac.wordpress.org/changeset/3627041/phastpress/trunk/sdk/phast.php
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&new=3627042%40phastpress%2Ftags%2F3.11&old=3578731%40phastpress%2Ftags%2F3.10
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/1c3fbca2-f11f-4f9c-9d70-eea98bdfd3b0?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T05:52:45.975Z'
---

## Overview

The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.