Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2022-0591

CWE-918 — Server-Side Request Forgery (SSRF)5 documents5 sources

Severity

9.1CRITICAL

EPSS

87.9%

top 0.52%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Unknown Formcraft Subtlewebinc Formcraft3

Timeline

PublishedMar 21

Latest updateMar 22

Description

The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5unknown/formcraft3.8.28 — 3.8.28

▶NVDsubtlewebinc/formcraft3< 3.8.28

🔴Vulnerability Details

GHSA

GHSA-x9wp-hprc-2gvq: The FormCraft WordPress plugin before 3↗2022-03-22

▶

CVEList

Formcraft3 < 3.8.28 - Unauthenticated SSRF↗2022-03-21

▶

VulnCheck

subtlewebinc formcraft3 Server-Side Request Forgery (SSRF)↗2022

▶

💥Exploits & PoCs

Nuclei

Formcraft3 <3.8.28 - Server-Side Request Forgery

▶