Which versions of Typecho are affected by CVE-2026-7025?

Typecho versions up to 1.3.0 contain an unauthenticated server-side request forgery vulnerability in the Pingback Service that allows attackers to force your servers to make arbitrary requests to…

Is there a public PoC exploit available for CVE-2026-7025?

Yes, a public proof-of-concept exploit is available for CVE-2026-7025. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7025?

Within 24 hours: inventory all Typecho installations and identify those running versions 1.3.0 or earlier; disable the Pingback Service via configuration or firewall rules blocking access to pingback endpoints. Within 7 days: apply network segmentation to restrict outbound HTTP/HTTPS requests from Typecho servers to authorized destinations only; implement request logging and alerting on Pingback Service endpoints. Within 30 days: upgrade to Typecho version 1.3.1 or later if vendor releases a patch, or migrate to an alternative platform if patch availability remains uncertain.

Typecho CVE-2026-7025

Q: What is the CVSS score of CVE-2026-7025?

CVE-2026-7025 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25700 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-26 VulDB

PHP SSRF N A Typecho

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 26, 2026 - 08:22 NVD

HIGH MEDIUM

CVSS changed

Apr 26, 2026 - 08:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 26, 2026 - 08:00 vuln.today

EUVD ID Assigned

Apr 26, 2026 - 07:45 euvd

EUVD-2026-25700

Analysis Generated

Apr 26, 2026 - 07:45 vuln.today

CVE Published

Apr 26, 2026 - 07:00 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery in Typecho's Pingback Service (versions up to 1.3.0) allows remote unauthenticated attackers to force the server to make arbitrary HTTP requests to internal or external resources. The vulnerability resides in Service::sendPingHandle() function where attacker-controlled X-Pingback and link parameters bypass validation. Public exploit code exists (documented in researcher blog post), enabling immediate weaponization. CVSS 7.3 reflects network-accessible attack with no authentication required. EPSS data not available, but public POC significantly elevates real-world risk. Vendor non-responsive to early disclosure.

Technical ContextAI

Typecho is a PHP-based lightweight blogging platform. The vulnerability exists in the Pingback protocol implementation (var/Widget/Service.php), specifically the Service::sendPingHandle() function. Pingback is a legacy blog-to-blog notification protocol where a client sends XML-RPC requests containing source and target URLs. The flaw (CWE-918: Server-Side Request Forgery) occurs when the service processes X-Pingback headers and link parameters without proper validation of the destination URL. This allows attackers to manipulate the server into making HTTP requests to arbitrary endpoints, potentially accessing internal services behind firewalls (cloud metadata endpoints, internal APIs, databases) or performing port scanning and service enumeration. The CPE indicates all versions through 1.3.0 are affected, suggesting a long-standing architectural issue in the Pingback implementation rather than a recent regression.

RemediationAI

No vendor-released patch exists at time of analysis due to vendor non-responsiveness to early disclosure. Immediate compensating controls required: (1) Disable Pingback functionality entirely if not required for business operations - this is the most effective mitigation as Pingback is a legacy protocol rarely used in modern blogging workflows; disable by removing or commenting out Pingback route handlers in Typecho configuration. Trade-off: loss of automated blog-to-blog notifications. (2) Implement strict egress filtering at network perimeter and host firewall levels to block server-initiated requests to RFC1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.0/8), link-local addresses (169.254.0.0/16), and cloud metadata endpoints (169.254.169.254). Trade-off: may break legitimate integrations requiring external HTTP requests. (3) Deploy web application firewall (WAF) rules to inspect and block suspicious X-Pingback headers and XML-RPC payloads containing internal IP addresses or sensitive URL patterns. Trade-off: requires ongoing rule tuning to prevent false positives. (4) If Pingback must remain enabled, implement application-level URL allowlisting restricting pingback targets to known external blog domains only. Monitor server-side HTTP request logs for anomalous destination patterns. Consult researcher disclosure at https://wang1rrr.github.io/2026/03/04/CVE-Report-Typecho-v1-3-0-SSRF/ for technical indicators to inform detection rules. Consider migrating to actively maintained blogging platforms given vendor abandonment signals.