CVE-2022-3590

MEDIUM EXPLOITED IN THE WILD NUCLEI

WordPress 4.2-6.1.1 - Unauthenticated Blind SSRF via Pingback TOCTOU Race Condition

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-3590 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 3 public exploits from researchers including hxlxmj, huynhvanphuc. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a Python script that scans WordPress websites for the CVE-2022-3590 vulnerability, which involves an unauthenticated blind SSRF in the pingback feature. The script checks for WordPress version, pingback feature availability, and sends a crafted XML-RPC request to determine vulnerability.

Description

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

Exploits (3)

nomisec SCANNER 8 stars
by hxlxmj · infoleak
https://github.com/hxlxmj/CVE-2022-3590-WordPress-Vulnerability-Scanner

This repository contains a Python script that scans WordPress websites for the CVE-2022-3590 vulnerability, which involves an unauthenticated blind SSRF in the pingback feature. The script checks for WordPress version, pingback feature availability, and sends a crafted XML-RPC request to determine vulnerability.

Classification
Scanner 95%
Attack Type
Ssrf
Complexity
Moderate
Reliability
Reliable
Target: WordPress (versions <= 6.2)
No auth needed
Prerequisites: Target WordPress site with pingback feature enabled · Attacker-controlled domain for interaction testing
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER
by huynhvanphuc · infoleak
https://github.com/huynhvanphuc/CVE-2022-3590-WordPress-Vulnerability-Scanner

This repository contains a Python script that scans WordPress websites for the CVE-2022-3590 vulnerability, which involves an unauthenticated blind SSRF in the pingback feature. The script checks for WordPress version, pingback feature availability, and sends a crafted payload to determine vulnerability.

Classification
Scanner 95%
Attack Type
Ssrf
Complexity
Moderate
Reliability
Reliable
Target: WordPress (versions <= 6.2)
No auth needed
Prerequisites: Python 3 · requests library · Interactsh domain for payload delivery
devstral-2 · analyzed Feb 18, 2026 Full analysis →
inthewild SCANNER
poc
https://github.com/hxlxmjxbbxs/cve-2022-3590-wordpress-vulnerability-scanner

This repository contains a Python script that scans WordPress websites for the CVE-2022-3590 vulnerability, which involves an unauthenticated blind SSRF in the pingback feature. The script checks for WordPress version, pingback feature availability, and sends a crafted XML-RPC request to test for vulnerability.

Classification
Scanner 95%
Attack Type
Ssrf
Complexity
Moderate
Reliability
Reliable
Target: WordPress (versions <= 6.2)
No auth needed
Prerequisites: WordPress site with pingback feature enabled · Attacker-controlled domain for SSRF detection
devstral-2 · analyzed Feb 23, 2026 Full analysis →

Nuclei Templates (1)

WordPress <= 6.2 - Server Side Request Forgery
MEDIUMVERIFIEDby riteshs4hu
Shodan: cpe:"cpe:2.3:a:wordpress:wordpress" || http.component:"wordpress"
FOFA: body="oembed" && body="wp-"

References (2)

Core 2
Core References
Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/c8814e6e-78b3-4f63-a1d3-6906a84c1f11

Scores

CVSS v3 5.9
EPSS 0.9031
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2024-09-18
InTheWild.io 2024-09-18
CWE
CWE-367
Status published
Products (2)
wordpress/wordpress 4.1
wordpress/wordpress 4.2 - 6.1.1
Published Dec 14, 2022
Tracked Since Feb 18, 2026