What is the CVSS score of EUVD-2026-38670?

EUVD-2026-38670 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Kargo Takip are affected by EUVD-2026-38670?

WordPress sites using the Kargo Takip plugin through version 1.2 are exposed to credential theft, as the vulnerability allows unauthenticated attackers to steal cloud credentials and internal service…

How to fix or mitigate EUVD-2026-38670?

Within 24 hours: Identify all WordPress instances using Kargo Takip plugin; disable and remove the plugin immediately from all installations. Within 7 days: Audit server and cloud logs for exploitation attempts; rotate any exposed cloud credentials, API keys, and instance metadata tokens; verify no unauthorized access occurred. Within 30 days: Deploy a patched version of the plugin once released by vendor, or implement and test a vendor-approved alternative shipping tracking solution.

Kargo Takip EUVD-2026-38670

| CVE-2026-12095 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-24 Wordfence

GHSA-mjcx-qfvm-369j

SSRF WordPress Kargo Takip

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

8.6 HIGH

Unauthenticated network SSRF with scope change to internal services; raised C to H because echoed 'auth' field directly exfiltrates credentials, no integrity/availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 06:55 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

HIGH 7.2

DescriptionCVE.org

The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'api_url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The script echoes internal API response data (specifically the value of any 'auth' key in a JSON response body) verbatim back to the attacker's browser, enabling direct exfiltration of responses from internal services such as cloud instance metadata endpoints.

Articles & Coverage 1

News 18 New WordPress Vulnerabilities - 2 Critical, 6 With POC Jun 25, 2026

AnalysisAI

Server-side request forgery in the Kargo Takip WordPress plugin (versions through 1.2) allows unauthenticated remote attackers to coerce the site into issuing arbitrary HTTP requests via the 'api_url' parameter and to exfiltrate data from internal services. Because the plugin echoes the value of any 'auth' key from the JSON response back to the attacker, it enables direct retrieval of sensitive responses such as cloud instance metadata credentials. No public exploit identified at time of analysis, and the plugin is not listed in CISA KEV.

Technical ContextAI

Kargo Takip is a Turkish-language shipment/cargo tracking plugin for WordPress (vendor 'bytuncay', CPE cpe:2.3:a:bytuncay:kargo_takip). The flaw resides in ui/decodeandview.php, which accepts a user-controlled 'api_url' parameter and uses it to perform a server-side HTTP request without validating the destination host or scheme. This is a textbook CWE-918 (Server-Side Request Forgery): the server acts as a confused deputy, reaching into network positions (loopback, RFC1918, link-local 169.254.169.254 metadata endpoints) the attacker cannot reach directly. The additional echoing of the JSON 'auth' field amplifies the impact from blind SSRF to a data-exfiltration primitive, since cloud metadata services such as AWS IMDSv1, GCP, and Azure return credentials in response bodies that can be parsed for an 'auth' key or otherwise reflected back.

RemediationAI

No vendor-released patch identified at time of analysis - the references point to the current trunk source of the vulnerable file, not a tagged fixed release. Until a fixed version is published, the most reliable remediation is to deactivate and uninstall the Kargo Takip plugin (trade-off: shipment/cargo tracking functionality is lost). If the plugin must remain enabled, restrict access to the decodeandview.php endpoint via WAF or web-server rules (e.g., block external requests to /wp-content/plugins/kargo-takip/ui/decodeandview.php, or filter requests carrying an 'api_url' parameter), and, for cloud-hosted WordPress instances, enforce IMDSv2 with hop-limit 1 and remove or scope down any attached IAM role to deny the WordPress host access to sensitive metadata (trade-off: legitimate workloads that rely on IMDSv1 must be reworked). Egress filtering from the WordPress host to RFC1918, loopback, and 169.254.169.254 further reduces SSRF blast radius. Monitor the Wordfence advisory page for an official fixed version.