CVE-2026-66437

Executive Summary

CVE-2026-66437 is a Server Side Request Forgery (SSRF) vulnerability discovered in the Feedzy WordPress plugin, affecting all versions up to and including 5.2.4. The flaw allows a user with Contributor-level access to craft requests that force the WordPress server to make outbound HTTP requests to arbitrary internal or external resources. This can lead to information disclosure, port scanning, or interaction with internal cloud metadata endpoints (e.g., AWS EC2). The vulnerability has a CVSS score of 4.9 (Medium), but due to the low exploitability score (EPSS 0.0%) and absence of public exploit code, active exploitation is currently unlikely. No official patch exists at this time. As a WordPress ecosystem component, the attack surface is limited to administrative or Contributor accounts, but the impact is amplified by the ability to bypass network segmentation and extract sensitive data.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – Contributor role required.
• User Interaction: None (UI:N) – no victim interaction needed.
• Scope: Unchanged (S:U) – vulnerability cannot jump to other security domains.
• Confidentiality Impact: Low (C:L) – limited data disclosure.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (inferred from NVD data)

Given the Contributor privilege requirement, the threat is moderate. However, SSRF can be weaponized with public cloud metadata services to retrieve IAM credentials, making the actual impact potentially higher than the CVSS score suggests.

Deep Dive & Mechanics

Feedzy is a WordPress RSS feed importer plugin. The Contributor Server Side Request Forgery (SSRF) occurs when the plugin processes user‑supplied URLs (e.g., feed sources) without adequate validation. A Contributor-level user can submit a request to an internal IP address (like 169.254.169.254 on AWS) or an internal service (e.g., http://localhost:9200) via the plugin's admin interface. The plugin then fetches the resource using WordPress HTTP API (wp_remote_get), which respects DNS and IP routing, thereby proxying the request through the server.

The vulnerability lies in the lack of a URL blocklist and IP range filtering for the feed URL parameter. Classic SSRF patterns include:

• Crafting URLs pointing to 127.0.0.1, 0.0.0.0, or cloud metadata endpoints.
• Using DNS rebinding to bypass simple hostname checks.
• Exploiting open redirects from external services to pivot internally.

No official patch or advisory from the vendor has been released as of this report.

Vulnerable vs. Patched Code

Since no patch is available, we cannot show a side‑by‑side diff. However, the vulnerable code likely resembles:

// Vulnerable snippet (hypothetical)
$feed_url = $_POST['feed_url'];
$response = wp_remote_get( $feed_url );
// No validation of IP or scheme

A patched version (when released) would include:

• A function to reject private/reserved IPs.
• Enforcement of allowed schemes (e.g., http:// and https:// only).
• Support for a safelist of allowed domains or use of wp_safe_remote_get().

In the absence of a vendor patch, site administrators should consider hardening via WAF rules or disabling the plugin.

Exploitation & Lab Setup

Red Team Approach

1. Prerequisites: Obtain Contributor‑level WordPress credentials (e.g., via phishing or weak password).
2. Craft the SSRF Payload:
   • Click “Add New” in Feedzy.
   • In the feed URL field, enter: http://169.254.169.254/latest/meta-data/ (AWS) or http://127.0.0.1:9200/ (Elasticsearch).
3. Execute: Save the feed. The plugin will fetch the URL and render the response or metadata in the admin interface.
4. Harvest: Extract IAM roles, internal service banners, or application credentials.

Blue Team Detection

• Monitor outbound HTTP requests from the WordPress server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16).
• Audit Contributor activities, especially new RSS feed additions containing suspicious URLs.
• Deploy a Web Application Firewall (WAF) rule to block URLs pointing to private IPs.

Indicators of Compromise (IOCs)

• Log Patterns:
  • WordPress debug.log entries with wp_remote_get calls to private IPs.
  • Apache/Nginx access logs showing GET /wp-admin/admin-ajax.php?action=feedzy_add_feed (or similar) with parameters containing internal IPs.
• Network Indicators:
  • Outbound connections from the WordPress server to 169.254.169.254, 10.x.x.x, 172.x.x.x, 192.168.x.x.
  • DNS queries for internal hostnames or cloud metadata domains.
• File System: Unusual files in /wp-content/uploads/feedzy/ containing metadata responses.

Detection Engineering

YARA Rule

rule CVE_2026_66437_Feedzy_SSRF {
    meta:
        description = "Detects SSRF attempts via Feedzy plugin"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "CVE-2026-66437"
    strings:
        $url_pattern = /(wp_remote_get|wp_safe_remote_get)\s*\(\s*["'][a-z0-9\/:\.]*\b(127\.0\.0\.1|169\.254\.169\.254|0\.0\.0\.0|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3})/
        $feed_func = "add_feed"
        $admin_ajax = "admin-ajax.php"
    condition:
        any of ($url_pattern) or ($feed_func and $admin_ajax)
}

Sigma Rule

title: Feedzy SSRF Attempt
description: Detects SSRF payloads in Feedzy feed URL parameter
status: experimental
author: Valters IT
logsource:
    category: webserver
    product: apache
selection:
    cs-method: POST
    cs-uri-stem: /wp-admin/admin-ajax.php
    cs-uri-query: action=feedzy_add_feed
    c-ip|startswith: 127.
falsepositives:
    - Legitimate use of localhost for development
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2026-66437 Feedzy SSRF detected";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=feedzy_add_feed"; http_client_body;
    content:"feed_url"; http_client_body;
    pcre:"/(127\.0\.0\.1|169\.254\.169\.254|10\.\d{1,3}\.\d{1,3}\.\d{1,3})/Ri";
    reference:cve,2026-66437;
    classtype:attempted-information-leak;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Workaround:
   • Disable or remove the Feedzy plugin until a patch is released.
   • Restrict Contributor roles from using Feedzy via custom capabilities or user‑role editor plugin.
2. Network Hardening:
   • Block outbound traffic from the WordPress server to private IP ranges using iptables, cloud‑provider firewalls, or web‑server configurations.
   • Use a forward proxy that denies requests to internal networks.
3. WAF Rules:
   • Deploy ModSecurity or cloud WAF (AWS WAF, Cloudflare) with rules blocking URL parameters containing private IP addresses.
4. Monitoring:
   • Enable detailed logging of all wp_remote_get calls via custom plugin or WordPress hooks.
   • Alert on connections to 169.254.169.254 or 127.0.0.1.
5. Vendor Action:
   • Contact Feedzy support for patch ETA and subscribe to their security advisories.

Valters IT
Senior DevSecOps & Threat Intelligence Expert