CVE-2022-0591

CRITICAL EXPLOITED NUCLEI

FormCraft WP <3.8.28 - SSRF

Title source: llm

Description

The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users

Exploits (2)

github NO CODE 2 stars
by tomorroisnew · poc
https://github.com/tomorroisnew/CVE/tree/main/CVE-2022-0591
nomisec SCANNER 1 stars
by im-hanzou · infoleak
https://github.com/im-hanzou/FC3er

Nuclei Templates (1)

Formcraft3 <3.8.28 - Server-Side Request Forgery
CRITICALVERIFIEDby Akincibor,j4vaovo
FOFA: body="formcraft3" && body="wp-"

References (1)

Scores

CVSS v3 9.1
EPSS 0.8790
EPSS Percentile 99.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

VulnCheck KEV 2023-11-14
CWE
CWE-918
Status published
Products (1)
subtlewebinc/formcraft3 < 3.8.28
Published Mar 21, 2022
Tracked Since Feb 18, 2026