What is the CVSS score of CVE-2026-32412?

CVE-2026-32412 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-32412?

CVE-2026-32412 presents moderate security risk, a server-side request forgery vulnerability rated CVSS 5.4. Users could be tricked into performing unintended actions.

How to fix or mitigate CVE-2026-32412?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-32412

EUVD-2026-11930 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-13 Patchstack

SSRF WordPress

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11930

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 5.4

DescriptionCVE.org

Server-Side Request Forgery (SSRF) vulnerability in Gift Up! Gift Up Gift Cards for WordPress and WooCommerce gift-up allows Server Side Request Forgery.This issue affects Gift Up Gift Cards for WordPress and WooCommerce: from n/a through <= 3.1.7.

AnalysisAI

A Server-Side Request Forgery (SSRF) vulnerability exists in Gift Up! Gift Cards for WordPress and WooCommerce plugin versions up to 3.1.7, allowing unauthenticated attackers to make arbitrary HTTP requests from the vulnerable server. This could enable attackers to access internal services, scan internal networks, or exfiltrate sensitive data from systems accessible only to the server. The vulnerability has a CVSS score of 5.4 (Medium) with network-based attack vector and low impact on confidentiality and integrity.

Technical ContextAI

The vulnerability is classified as CWE-918 (Server-Side Request Forgery), which occurs when user-controlled input is insufficiently validated before being passed to network operations. In the context of the Gift Up! plugin for WordPress/WooCommerce (identifiable via CPE wp:giftup-gift-cards), the plugin likely accepts URL parameters or configuration inputs that are then used in server-side HTTP requests without proper validation or allowlisting. This enables attackers to manipulate the target of these requests to reach internal IP addresses, cloud metadata endpoints (such as AWS EC2 IMDSv1), internal APIs, or other sensitive network resources that should be isolated from the public internet.

RemediationAI

Upgrade Gift Up! Gift Cards for WordPress and WooCommerce to version 3.1.8 or later immediately upon availability. Until patching is completed, implement network-level mitigations by restricting outbound HTTP/HTTPS requests from the WordPress application server to an explicit allowlist of trusted external domains and blocking all requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16). Additionally, disable or restrict access to cloud metadata endpoints if running on AWS, Azure, or GCP. If the plugin's functionality permits, configure it to reject requests to non-standard ports and internal hostnames. Monitor application logs for unusual outbound connection attempts.