CVE-2026-3712

Executive Summary

CVE-2026-3712 is a Server-Side Request Forgery (SSRF) vulnerability in the PhastPress plugin for WordPress, affecting all versions up to and including 3.10. The flaw allows unauthenticated attackers to manipulate the HTTP Host header so that the plugin's scripts service endpoint builds an internal URL whitelist from attacker-controlled input, bypassing the whitelist and forcing the server to issue requests to arbitrary internal or external destinations. Because the response content is returned to the attacker and no authentication is required, the issue exposes internal network services and metadata endpoints to reconnaissance and data exfiltration, earning a CVSS base score of 7.3 (High).

Technical Analysis

The vulnerability is classified under CWE-918 (Server-Side Request Forgery). At its core, an SSRF flaw arises when a server-side application trusts user-supplied input to determine the destination of an outbound network request. In CVE-2026-3712, the trust boundary failure is specific and well-defined in the NVD description: the PhastPress plugin exposes a "scripts service endpoint" that constructs its URL whitelist dynamically from the attacker-controlled HTTP Host header.

A URL whitelist is a security control intended to constrain outbound requests to a set of approved, trusted destinations. Its integrity depends entirely on the list being derived from a trusted, static, or server-controlled source. Here, because the whitelist is generated at request time from the Host header — a value fully controllable by the client — the control is self-defeating. The attacker sets the Host header to match whatever destination they wish to reach, causing the dynamically generated whitelist to include that target. The subsequent request then passes the (meaningless) whitelist check and is executed by the server.

The attack surface is the HTTP request handling layer of the plugin endpoint. The vulnerable component is unauthenticated — no valid session, nonce, or WordPress user role is required — which significantly lowers the barrier to exploitation and allows automated, internet-wide scanning. The impact of the request itself is constrained by the "return the response content" behavior described in the advisory: the server does not merely make a blind request but reflects the response back, turning a blind SSRF into a full-read SSRF.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicates network exploitability, low attack complexity, no privileges required, no user interaction, unchanged scope, and low confidentiality, integrity, and availability impacts. The "Low" confidentiality rating is notable: while arbitrary internal access is possible, the per-request nature and lack of demonstrated chained impact keep the single-shot data exposure at the Low band. The Low integrity and availability scores reflect that an attacker can alter server-side state (issuing requests) and consume server resources.

Because the advisory does not name specific functions, classes, or parameter names beyond the "scripts service endpoint" and the HTTP Host header, the analysis must remain at the vulnerability-class level. No public proof-of-concept, Nuclei template, or exploit code is available, and the CNA title field is empty. Reconnaissance into the exact internal endpoint path and parameters is left to the reader and must be performed only against systems the reader is authorized to test.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (SSRF via dynamic whitelist construction) and the details provided in the NVD description.

1. Reconnaissance / target identification. The attacker identifies a WordPress site running PhastPress (detectable via plugin asset paths and version banners for versions <= 3.10). Because exploitation requires no authentication, no account enumeration or credential harvesting is needed. The attacker locates the plugin's scripts service endpoint through normal HTTP enumeration.

2. Triggering the flaw. The attacker sends an HTTP request to the scripts service endpoint and manipulates the Host header so that it matches the URL they want the server to fetch. Since the endpoint builds its URL whitelist dynamically from the Host header, the spoofed value is incorporated into the whitelist, allowing the target URL to satisfy the check. This is the whitelist-bypass mechanism described by the vulnerability.

3. Payload / execution at the vulnerability-class level. With the whitelist subverted, the attacker supplies (via the endpoint's normal request flow or Host manipulation) the destination URL. The server issues the outbound HTTP request to that destination. Typical SSRF targets include:

   • Loopback and internal-only services (127.0.0.1, localhost, RFC1918 ranges) that are not externally reachable.
   • Cloud instance metadata endpoints (e.g., the well-known link-local metadata address) to retrieve credentials or configuration — note: the specific metadata URL is not stated in the advisory and should be enumerated per environment.
   • Internal admin panels, databases, or orchestration APIs reachable from the web server. The server then returns the fetched response content to the attacker.

4. Post-exploitation impact. Response content is reflected to the attacker, enabling data exfiltration and mapping of the internal network. Retrieved metadata or internal API responses may yield credentials or tokens that facilitate lateral movement and privilege escalation. The ability to force server-side requests can also be abused for port scanning and service discovery across the internal estate.

Impact Assessment

The CVSS base score is 7.3 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Impact interpretation:

• Confidentiality (Low): Response reflection enables retrieval of internal resource content. In environments where the web server can reach cloud metadata or internal admin interfaces, a single request can expose sensitive credentials or data. The Low rating reflects per-request, non-aggregated exposure, but real-world blast radius may be substantially larger in cloud-hosted deployments.
• Integrity (Low): The attacker can cause the server to perform unintended requests; in some SSRF contexts this can mutate internal state, though the advisory does not describe write operations.
• Availability (Low): Outbound request generation may be abused to consume server resources or interact with rate-limited internal services.
• Scope (Unchanged): The vulnerable component and affected resources are treated as within the same security authority for scoring purposes, though the practical ability to pivot to internal services crosses traditional network trust boundaries.

Affected systems: Any WordPress installation with the PhastPress plugin at version <= 3.10 that is internet-exposed. Given PhastPress is a performance/asset-optimization plugin, affected sites may span small business, media, and enterprise WordPress deployments. Blast radius depends directly on the web server's internal network position — cloud-hosted instances with reachable metadata services and flat internal networks face the greatest risk.

Detection Guidance

Sigma Rule

title: PhastPress SSRF via Host Header Whitelist Bypass (CVE-2026-3712)
id: 8b1c4e2a-3f7d-4a91-9c6e-2d5b7a0f1e33
status: experimental
description: Detects requests to the PhastPress scripts service endpoint where the Host header is spoofed to match a target URL, consistent with SSRF whitelist bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-3712
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: wordpress
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'phastpress'
      - 'scripts'
  selection_host_anomaly:
    cs-host|contains:
      - '127.0.0.1'
      - 'localhost'
      - '169.254.'
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_endpoint and selection_host_anomaly
falsepositives:
  - Internal health checks with anomalous hosting configurations
level: high

YARA Rule

rule CVE_2026_3712_PhastPress_SSRF
{
    meta:
        description = "Detects PhastPress plugin files potentially affected by CVE-2026-3712 SSRF via Host header"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-3712"
        date = "2026-01-01"
        severity = "high"

    strings:
        $pp = "PhastPress" ascii wide nocase
        $host = "HTTP_HOST" ascii wide
        $script = "scripts" ascii wide nocase
        $version = /Version:\s*3\.(?:[0-9]|10)\b/ ascii

    condition:
        uint16(0) == 0x3C3F or uint16(0) == 0x3F3C
        and filesize < 5MB
        and $pp
        and $host
        and $script
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-3712 PhastPress SSRF Host Header Whitelist Bypass Attempt"; flow:to_server,established; http.host; content:"phastpress"; nocase; http.uri; content:"scripts"; nocase; http.header; content:"Host|3a|"; nocase; pcre:"/Host\x3a\s*(?:127\.0\.0\.1|localhost|169\.254\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/Hi"; reference:cve,2026-3712; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-3712; classtype:attempted-recon; sid:2026371201; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where network.protocol == "http" and
      url.path : "*phastpress*" and url.path : "*scripts*" ]
  [ network where network.protocol == "http" and
      http.request.headers.Host : ("127.0.0.1" or "localhost" or "169.254.*" or "10.*" or "192.168.*" or "172.16.*") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=wordpress
| eval endpoint=lower(uri)
| eval hostheader=lower(host)
| where (match(endpoint,"phastpress") AND match(endpoint,"scripts"))
| where (match(hostheader,"127\.0\.0\.1") OR match(hostheader,"localhost") OR match(hostheader,"169\.254\.") OR match(hostheader,"^10\.") OR match(hostheader,"192\.168\.") OR match(hostheader,"^172\.(1[6-9]|2[0-9]|3[01])\."))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip host hostheader uri
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,phastpress,">
  <rule id="20263712" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">phastpress</field>
    <field name="url">scripts</field>
    <regex field="http_host" type="pcre2">127\.0\.0\.1|localhost|169\.254\.|^10\.|192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.</regex>
    <description>CVE-2026-3712: PhastPress SSRF Host header whitelist bypass attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch; not independently confirmed).

1. Immediate mitigations (in the absence of a confirmed patch):

   • Restrict the WordPress web server's outbound network egress to only required external destinations using host-based firewalls, security groups, or egress ACLs. Block the server from reaching internal-only and link-local (e.g., 169.254.0.0/16) ranges.
   • Enforce cloud instance metadata protections (require session tokens / IMDSv2 where applicable) so that even if a request reaches the metadata service it cannot be used to retrieve credentials.
   • Place the WordPress upstream behind a reverse proxy or WAF that normalizes and validates the Host header, rejecting host values that do not match the site's canonical domain.
   • Segregate WordPress hosting into its own network segment with no direct access to internal admin planes or databases.

2. Patch/upgrade steps:

   • Because the patch status is CLAIMED and derived from a single source, verify against the official PhastPress changelog and the WordPress plugin repository before relying on any specific version. The vulnerability affects "all versions up to, and including, 3.10"; a fixed release is claimed to exist after 3.10.
   • Update PhastPress to the latest vendor-published version, or deactivate and remove the plugin if no confirmed fix is available.
   • If the site cannot be patched immediately, disable the affected plugin until a fix is verified.

3. Long-term hardening:

   • Eliminate dynamic, request-derived security controls. Whitelists and allowlists must be derived from server-side configuration, not client-supplied headers such as Host.
   • Treat the Host header as untrusted input across the application stack; validate it against a static allowlist of expected hostnames.
   • Maintain an authoritative WordPress plugin inventory with version tracking and automated vulnerability alerting.
   • Subscribe to NVD/WordPress security feeds for CVE-2026-3712 updates, and monitor for patch confirmation before assuming remediation is complete.

References

1. NVD — CVE-2026-3712: https://nvd.nist.gov/vuln/detail/CVE-2026-3712
2. CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
3. WordPress Plugin Directory — PhastPress (verify current version and changelog): https://wordpress.org/plugins/phastpress/
4. OWASP — Server-Side Request Forgery Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
5. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / exploit-in-the-wild evidence: None available. CVE-2026-3712 is not listed in CISA KEV, has no public PoC, no Nuclei template, and no known exploit code as of this report. EPSS has not yet been scored by FIRST.org.