CVE-2026-65442: FormCraft SSRF Vulnerability

CVE-2026-65442 Overview

CVE-2026-65442 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability affecting the FormCraft WordPress plugin versions 3.9.15 and earlier. The flaw allows remote attackers to coerce the WordPress server into issuing HTTP requests to arbitrary destinations without authentication. Because the request originates from the trusted server, attackers can reach internal network resources, cloud metadata endpoints, and other assets normally shielded from the public internet. The issue is tracked as CWE-918: Server-Side Request Forgery.

Critical Impact
An unauthenticated attacker can force the vulnerable WordPress instance to send crafted HTTP requests to internal or external endpoints, enabling internal network reconnaissance and interaction with services otherwise unreachable from the internet.

Affected Products

FormCraft WordPress plugin versions <= 3.9.15
WordPress sites with FormCraft installed and network-accessible
Hosting environments exposing metadata services (for example, cloud instance metadata endpoints) to the WordPress process

Discovery Timeline

2026-07-27 - CVE-2026-65442 published to the National Vulnerability Database (NVD)
2026-07-28 - NVD record last modified

Technical Details for CVE-2026-65442

Vulnerability Analysis

The vulnerability resides in a FormCraft plugin endpoint that fetches remote resources based on user-controlled input without validating the destination URL. An unauthenticated attacker submits a crafted request containing an attacker-chosen URL, and the WordPress server issues an outbound HTTP request on the attacker's behalf. The response, or side effects of the request, can be observed or leveraged for further attack stages.

SSRF weaknesses in WordPress plugins typically enable attackers to probe internal network ranges, interact with services bound to localhost, and query cloud metadata endpoints such as 169.254.169.254. On misconfigured cloud instances, this can lead to disclosure of temporary credentials associated with the underlying compute role.

Because exploitation requires no authentication and no user interaction, the attack surface is any FormCraft installation reachable over the network. The scope-changed CVSS vector reflects impact on resources beyond the vulnerable WordPress process itself. The EPSS probability at publication is 0.159%.

Root Cause

The root cause is missing or insufficient validation of a user-supplied URL parameter processed by the plugin. FormCraft passes the attacker-controlled value to an HTTP client without enforcing an allowlist of hosts, blocking private IP ranges, or restricting protocol handlers. This maps directly to CWE-918.

Attack Vector

Exploitation occurs over the network against a public FormCraft endpoint. The attacker sends an HTTP request that includes a URL pointing to an internal or sensitive destination. The plugin performs the outbound fetch, and the attacker either receives content in the response or infers success from timing and error signals. No credentials, tokens, or user interaction are required.

See the Patchstack WordPress Vulnerability Report for the vendor-coordinated disclosure details.

Detection Methods for CVE-2026-65442

Indicators of Compromise

Outbound HTTP requests from the WordPress PHP worker to internal RFC1918 addresses, 127.0.0.1, or 169.254.169.254.
Access log entries targeting FormCraft plugin endpoints with URL-like parameter values from unauthenticated sources.
Unexpected DNS resolutions from the web server for attacker-controlled or internal hostnames.

Detection Strategies

Inspect web server access logs for unauthenticated requests to FormCraft plugin AJAX or REST routes containing http://, https://, or file:// values in parameters.
Correlate PHP-FPM or Apache process network activity with inbound plugin requests to identify SSRF-driven callouts.
Deploy WAF signatures that flag URL-shaped parameters pointing to private IP space or cloud metadata endpoints.

Monitoring Recommendations

Alert on any egress from web application servers to 169.254.169.254 or other metadata service addresses.
Track outbound connections from WordPress hosts to internal subnets that should not receive traffic from the DMZ.
Monitor FormCraft plugin endpoints for anomalous request volume and repeated parameter fuzzing patterns.

How to Mitigate CVE-2026-65442

Immediate Actions Required

Identify all WordPress installations running FormCraft <= 3.9.15 and prioritize patching or removal.
Restrict outbound network access from WordPress hosts to only required destinations using host or network firewall rules.
Block access to cloud instance metadata services from the web tier, or enforce IMDSv2 with hop-limit controls on AWS.

Patch Information

Refer to the Patchstack advisory for FormCraft SSRF for the current fixed version and vendor guidance. Upgrade FormCraft to a version later than 3.9.15 once the vendor patch is available and validated in a staging environment.

Workarounds

Deactivate and remove the FormCraft plugin until an upgrade is deployed.
Deploy WAF rules that reject requests to FormCraft endpoints when parameters contain URL schemes or private IP literals.
Enforce egress filtering so the WordPress PHP process cannot reach RFC1918 ranges, localhost, or metadata endpoints.

bash

# Example egress restriction using iptables on a WordPress host
# Block outbound access from the web server user to metadata and private ranges
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT