What is the CVSS score of CVE-2026-32553?

CVE-2026-32553 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of OttoKit are affected by CVE-2026-32553?

The OttoKit WordPress plugin (version 1.1.35 and earlier) contains an unauthenticated server-side request forgery vulnerability that enables external attackers to access internal networks and cloud…

How to fix or mitigate CVE-2026-32553?

Within 24 hours: Disable or uninstall OttoKit plugin version 1.1.35 and earlier on all WordPress instances via the admin dashboard and verify removal; audit server logs for suspicious outbound HTTP requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and to 169.254.169.254. Within 7 days: Deploy WAF rules to block SSRF patterns targeting internal networks and cloud metadata endpoints; review cloud provider IAM logs and access activity for unauthorized metadata service credential usage. Within 30 days: Establish automated vulnerability monitoring for WordPress plugins with alerts for high-severity CVEs, implement WordPress hardening (disable file editing, restrict plugins to trusted repositories), and configure network egress controls to restrict outbound connections to pre-approved business destinations only.

OttoKit CVE-2026-32553

EUVD-2026-60912 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-18 Patchstack

GHSA-8q96-xvg6-h5cm

WordPress SSRF Ottokit Wordpress Plugin Brainstorm Force

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Network-reachable unauthenticated endpoint with no complexity; S:C and C:L/I:L reflect SSRF reaching internal systems with partial data read and request injection capability.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:20 vuln.today

CVE Published

Aug 18, 2026 - 13:59 cve.org

HIGH 7.2

DescriptionCVE.org

Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.

AnalysisAI

Unauthenticated SSRF in OttoKit WordPress plugin (≤1.1.35) allows any remote attacker without credentials to coerce the host server into making arbitrary outbound HTTP requests to attacker-controlled targets, including internal network resources and cloud metadata endpoints. The CVSS S:C (Scope Changed) rating confirms the vulnerability crosses security boundaries beyond the WordPress instance itself, enabling internal network reconnaissance, credential harvesting from cloud metadata services (e.g., AWS IMDSv1), or interaction with internal APIs. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.

Technical ContextAI

OttoKit (CPE: cpe:2.3:a:brainstorm_force:ottokit) is a WordPress automation and workflow integration plugin by Brainstorm Force that orchestrates triggers and actions between WordPress plugins and external services. Its automation logic necessarily involves making outbound HTTP requests to external endpoints, making SSRF a structurally plausible risk surface. The root cause is CWE-918 (Server-Side Request Forgery), where user-supplied input controlling a URL or network destination is passed to server-side HTTP functions without adequate validation or allowlisting. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the vulnerable code path is reachable without authentication and without special network positioning, suggesting it lies in a publicly accessible REST API endpoint or unauthenticated webhook handler. S:C indicates the request-forging capability reaches systems or networks outside the WordPress application's own trust boundary.

RemediationAI

The primary remediation is to update OttoKit to a version released after 1.1.35. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-35-server-side-request-forgery-ssrf-vulnerability should be consulted to confirm the exact patched release version, which is not independently specified in the available intelligence. An upstream fix version has not been independently verified from this dataset, so administrators should check the WordPress plugin repository for the latest release. If immediate patching is not possible, network-level compensating controls include implementing strict egress firewall rules on the WordPress host to block outbound HTTP requests to RFC-1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254) - note this may break legitimate integration functionality that OttoKit requires. For cloud-hosted environments, enabling IMDSv2 (on AWS) mitigates credential theft via metadata SSRF, though the underlying vulnerability remains. Disabling the OttoKit plugin entirely is the most reliable temporary control until a patch is applied.