What is the CVSS score of CVE-2026-3478?

CVE-2026-3478 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-3478?

Organizations running the Content Syndication Toolkit WordPress plugin (versions 1.3 and below) are exposed to unauthenticated attacks that could allow threat actors to probe internal networks,…

How to fix or mitigate CVE-2026-3478?

Within 24 hours: Identify all WordPress instances running the Content Syndication Toolkit plugin and document affected systems; immediately disable the plugin if business operations permit. Within 7 days: Implement Web Application Firewall rules to block AJAX proxy requests to the vulnerable endpoint; review server logs for suspicious activity patterns consistent with SSRF exploitation. Within 30 days: Migrate to an alternative content syndication solution or await vendor patch release; conduct internal network assessment to identify what sensitive services were potentially exposed.

WordPress CVE-2026-3478

EUVD-2026-14149 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-21 Wordfence

GHSA-97j6-f74w-c455

WordPress SSRF

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14149

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

HIGH 7.2

DescriptionCVE.org

The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJAX action in the bundled ReduxFramework library. The plugin registers a proxy endpoint (wp_ajax_nopriv_redux_p) that is accessible to unauthenticated users. The proxy() method in the Redux_P class takes a URL directly from $_GET['url'] without any validation (the regex is set to /.*/ which matches all URLs) and passes it to wp_remote_request(), which does not have built-in SSRF protection like wp_safe_remote_request(). There is no authentication check, no nonce verification, and no URL restriction. The response from the requested URL is then returned to the attacker, making this a full-read SSRF. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal network ports, or interact with cloud metadata endpoints.

AnalysisAI

The Content Syndication Toolkit plugin for WordPress contains an unauthenticated Server-Side Request Forgery vulnerability that allows attackers to make arbitrary HTTP requests from the WordPress server. All versions up to and including 1.3 are affected through a bundled ReduxFramework library that exposes an unprotected AJAX proxy endpoint. Attackers can exploit this to query internal services, scan internal network ports, access cloud metadata endpoints, or interact with internal APIs without any authentication, representing a significant risk for reconnaissance and lateral movement in internal networks.

Technical ContextAI

The vulnerability resides in the Redux_P class within the ReduxFramework library bundled with the Content Syndication Toolkit plugin (CPE: cpe:2.3:a:benmoody:content_syndication_toolkit). The plugin registers a WordPress AJAX action 'redux_p' accessible via wp_ajax_nopriv_redux_p, meaning it does not require authentication. The proxy() method at line 219 of class.p.php retrieves a URL directly from the $_GET['url'] parameter and passes it to wp_remote_request() without validation. The regex pattern used for URL validation is set to /.*/ which matches any string, effectively providing no filtering. WordPress's wp_remote_request() function lacks the built-in SSRF protections found in wp_safe_remote_request(). This is a classic CWE-918 Server-Side Request Forgery vulnerability where user-controlled input directly determines the target of server-side HTTP requests. The absence of nonce verification at line 161 and authentication checks at line 7 further compounds the issue by allowing completely unauthenticated exploitation.

RemediationAI

Immediately upgrade the Content Syndication Toolkit plugin to a version newer than 1.3 that addresses this SSRF vulnerability, checking the WordPress plugin repository and the vendor's security advisories for the patched release. If an updated version is not yet available or immediate patching is not feasible, disable the Content Syndication Toolkit plugin entirely until a fix is released. As an additional mitigation layer, implement Web Application Firewall (WAF) rules to block requests to the wp-admin/admin-ajax.php endpoint with action=redux_p parameter, though this should be considered a temporary measure only. Network-level controls should be implemented to restrict outbound connections from the WordPress server to only necessary external resources, specifically blocking access to internal IP ranges (RFC 1918 addresses: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.0/8), link-local addresses (169.254.0.0/16), and cloud metadata endpoints. Monitor WordPress access logs for requests to admin-ajax.php with action=redux_p as potential exploitation attempts. Detailed technical analysis and mitigation guidance can be found in the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/f8381866-d991-4638-ab4d-3b8697acf414?source=cve.