CVE-2022-3708
CRITICALWeb Stories < 1.24.0 - Authenticated Server-Side Request Forgery via Hotlink Proxy REST API
Title source: llmDescription
The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
References (5)
Core 5
Core References
Patch, Third Party Advisory
https://github.com/GoogleForCreators/web-stories-wp/commit/3ad2099f95155d658624ffac2e34ce0da739e34b
Patch, Release Notes, Third Party Advisory
https://github.com/GoogleForCreators/web-stories-wp/compare/v1.24.0...v1.25.0
Product, Release Notes, Third Party Advisory
https://wordpress.org/plugins/web-stories
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/7817a840-325a-4709-8374-84bb32d98d0e?source=cve
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3708
Scores
CVSS v3
9.6
EPSS
0.0069
EPSS Percentile
48.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-918
Status
published
Products (2)
google/Web Stories
< 1.24.0
google/web_stories
< 1.25.0
Published
Oct 28, 2022
Tracked Since
Feb 18, 2026