CVE-2026-25428: TS Poll WordPress Plugin SSRF Vulnerability

CVE-2026-25428 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the TS Poll WordPress plugin developed by totalsoft. This security flaw allows authenticated attackers with high privileges to manipulate server-side requests, potentially enabling access to internal services and resources that should not be externally accessible. The vulnerability affects all versions of TS Poll through version 2.5.5.

Critical Impact

Authenticated attackers with administrative privileges can exploit this SSRF vulnerability to forge server-side requests, potentially accessing internal network resources, cloud metadata services, or other protected endpoints from the vulnerable WordPress server.

Affected Products

• TS Poll WordPress Plugin versions up to and including 2.5.5
• WordPress installations running vulnerable TS Poll plugin versions
• Web servers hosting affected WordPress configurations

Discovery Timeline

• 2026-02-19 - CVE CVE-2026-25428 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-25428

Vulnerability Analysis

This Server-Side Request Forgery vulnerability exists within the TS Poll WordPress plugin's request handling functionality. SSRF vulnerabilities occur when an application can be manipulated to make HTTP requests to arbitrary destinations chosen by an attacker, using the server as a proxy.

In the context of this WordPress plugin, the vulnerability requires network access and high-privilege authentication (administrator-level access), which limits the attack surface. However, once exploited, the changed scope means the vulnerability can affect resources beyond the vulnerable component itself, potentially impacting internal network infrastructure.

The vulnerability is classified under CWE-918 (Server-Side Request Forgery), which describes weaknesses where a web application fetches a remote resource without sufficiently validating the user-supplied URL. This can allow attackers to coerce the application into sending crafted requests to unexpected destinations.

Root Cause

The root cause of this vulnerability stems from insufficient validation of user-controlled input that influences outbound HTTP requests made by the TS Poll plugin. When the plugin processes certain poll-related functionality, it fails to properly sanitize or restrict URLs or request parameters, allowing an authenticated administrator to specify arbitrary endpoints for server-side requests.

The high complexity of exploitation (AC:H) suggests that specific conditions must be met for successful exploitation, possibly requiring particular plugin configurations or timing conditions.

Attack Vector

The attack vector for CVE-2026-25428 is network-based, requiring the attacker to have authenticated access to the WordPress administrative interface with high privileges. The exploitation flow typically involves:

1. An attacker with administrator-level access to the WordPress installation identifies the vulnerable TS Poll plugin functionality
2. The attacker crafts malicious input containing URLs pointing to internal resources or cloud metadata endpoints
3. The plugin processes this input and makes a server-side request to the attacker-specified destination
4. The server's response from internal resources is potentially returned to or observable by the attacker

Due to the changed scope (S:C), successful exploitation can impact confidentiality and integrity of resources beyond the vulnerable WordPress installation, such as internal services running on localhost, cloud instance metadata APIs (169.254.169.254), or other internal network endpoints.

Detection Methods for CVE-2026-25428

Indicators of Compromise

• Unusual outbound HTTP requests from the WordPress server to internal IP ranges (127.0.0.1, 10.x.x.x, 192.168.x.x, 172.16-31.x.x)
• Requests to cloud metadata endpoints such as 169.254.169.254 originating from the web application
• Unexpected network connections from the WordPress PHP process to non-standard ports or internal services
• Log entries showing administrative access to TS Poll configuration pages followed by anomalous outbound requests

Detection Strategies

• Monitor web application logs for TS Poll administrative actions that trigger server-side requests
• Implement egress filtering rules to detect and alert on requests to internal network ranges or metadata endpoints
• Deploy web application firewall (WAF) rules to identify SSRF patterns in request parameters
• Review WordPress audit logs for unusual administrator activity related to the poll-wp plugin

Monitoring Recommendations

• Enable verbose logging for outbound HTTP requests made by PHP processes on WordPress servers
• Configure network monitoring to alert on connections from web servers to internal infrastructure
• Implement real-time log analysis for WordPress administrative actions involving the TS Poll plugin
• Set up alerts for requests containing internal IP addresses or localhost references in application parameters

How to Mitigate CVE-2026-25428

Immediate Actions Required

• Update TS Poll WordPress plugin to the latest patched version as soon as a fix is available from totalsoft
• Review and restrict administrative access to WordPress installations running vulnerable versions
• Implement network-level egress filtering to prevent the WordPress server from connecting to internal resources
• Consider temporarily disabling the TS Poll plugin if it is not critical to operations until a patch is available

Patch Information

A security patch addressing this SSRF vulnerability should be obtained from the plugin vendor. Monitor the Patchstack vulnerability database for updates and patching information. Ensure WordPress automatic updates are enabled for plugins, or manually update to a version higher than 2.5.5 once released.

Workarounds

• Implement strict egress firewall rules on the WordPress server to block outbound connections to internal IP ranges and cloud metadata endpoints
• Deploy a Web Application Firewall (WAF) with SSRF detection rules to filter malicious requests
• Restrict administrative access to the WordPress installation using IP allowlisting or VPN requirements
• Consider using a security plugin that monitors and restricts outbound server requests from WordPress

# Example iptables rules to block common SSRF targets
# Block connections to localhost from web application
iptables -A OUTPUT -p tcp -d 127.0.0.0/8 -m owner --uid-owner www-data -j DROP

# Block connections to cloud metadata endpoint
iptables -A OUTPUT -p tcp -d 169.254.169.254 -m owner --uid-owner www-data -j DROP

# Block connections to private IP ranges
iptables -A OUTPUT -p tcp -d 10.0.0.0/8 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -p tcp -d 172.16.0.0/12 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -p tcp -d 192.168.0.0/16 -m owner --uid-owner www-data -j DROP