CVE-2026-3712: PhastPress WordPress Plugin SSRF Vulnerability

CVE-2026-3712 Overview

CVE-2026-3712 is a Server-Side Request Forgery (SSRF) vulnerability in the PhastPress plugin for WordPress affecting all versions up to and including 3.10. The scripts service endpoint builds its URL whitelist dynamically from the attacker-controlled HTTP Host header. Unauthenticated attackers can spoof this header to match any target URL and bypass the whitelist. The server then issues HTTP requests to arbitrary internal or external destinations and returns the response content to the attacker. This vulnerability is categorized under CWE-918.

Critical Impact
Unauthenticated attackers can force the WordPress server to proxy HTTP requests to internal network resources, cloud metadata services, and arbitrary external endpoints, exposing sensitive data from otherwise unreachable systems.

Affected Products

PhastPress WordPress Plugin versions up to and including 3.10
WordPress sites with PhastPress installed and the scripts service endpoint reachable
Fixed in PhastPress version 3.11

Discovery Timeline

2026-10-15 - CVE-2026-3712 published to the National Vulnerability Database (NVD)
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-3712

Vulnerability Analysis

The PhastPress plugin exposes a scripts service endpoint intended to proxy and optimize JavaScript resources. The endpoint enforces a URL whitelist to restrict which origins the server will fetch. The whitelist is not statically defined. Instead, it is constructed at request time from the HTTP Host header supplied by the client.

Because the Host header is attacker-controlled, an unauthenticated requester can set it to match the hostname of any URL they wish to retrieve. The whitelist check then passes, and the plugin issues the outbound HTTP request on behalf of the attacker. The response body is returned to the caller, giving the attacker full read access to the fetched resource.

The impact depends on the network position of the WordPress host. Attackers can reach internal services bound to loopback or private subnets, cloud instance metadata endpoints such as 169.254.169.254, and administrative interfaces that trust requests from the local network. For additional detail, see the Wordfence Vulnerability Report.

Root Cause

The root cause is trusting an HTTP request header to derive a server-side security control. Deriving the whitelist from the Host header collapses the distinction between the intended origin and attacker input. Any security decision made from this derived list is bypassable by setting the header to the target value.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker sends a crafted HTTP request to the PhastPress scripts service endpoint with a spoofed Host header pointing at the SSRF target. The plugin accepts the header, builds the whitelist to include that destination, fetches the target URL, and returns the response. Review the fix in the PhastPress 3.11 changeset and the full version diff for implementation specifics.

Detection Methods for CVE-2026-3712

Indicators of Compromise

Inbound HTTP requests to PhastPress endpoints (paths referencing phast.php or the scripts service) with a Host header that does not match the site's canonical hostname.
Outbound HTTP connections from the WordPress host to internal RFC1918 addresses, loopback, or cloud metadata IPs such as 169.254.169.254.
Web server access logs showing high volumes of PhastPress script endpoint requests from a single source with varied Host header values.

Detection Strategies

Alert on web server log entries where the Host header differs from the configured server name and the request targets a PhastPress endpoint.
Monitor egress traffic from the web tier for connections to private IP ranges, link-local addresses, and metadata service endpoints.
Use web application firewall (WAF) rules to flag or block requests to PhastPress script endpoints that carry non-canonical Host values.

Monitoring Recommendations

Enable verbose request logging on the WordPress reverse proxy to capture Host header values for forensic review.
Correlate PhastPress endpoint access with outbound DNS resolutions and HTTP connections initiated by the PHP process.
Track PhastPress plugin version across the WordPress estate and alert on hosts still running versions at or below 3.10.

How to Mitigate CVE-2026-3712

Immediate Actions Required

Update PhastPress to version 3.11 or later on every WordPress site in the environment.
Audit outbound connections from WordPress hosts for the past 90 days to identify unexpected requests to internal or metadata endpoints.
Restrict egress from the WordPress tier at the network layer so only required destinations are reachable.

Patch Information

The maintainers resolved the SSRF in PhastPress 3.11. The fix removes the dependency on the attacker-controlled Host header when constructing the URL whitelist. Review the upstream fix in the plugin changeset and the 3.10 to 3.11 version diff before deployment.

Workarounds

Deactivate and remove the PhastPress plugin until the upgrade to 3.11 can be completed.
Deploy a WAF rule that rejects requests to PhastPress script endpoints when the Host header does not match the site's canonical domain.
Block the WordPress host from reaching cloud metadata services and internal management subnets using host-based or network firewall rules.

bash

# Example nginx configuration to reject spoofed Host headers to PhastPress endpoints
server {
    server_name example.com;

    location ~* /phast\.php {
        if ($host != "example.com") {
            return 403;
        }
        # pass to PHP-FPM as normal
    }
}