EUVD-2026-96465
GHSA-9mj3-7x93-h5hq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running StreamCast
-
DeliverySend crafted request with attacker URL
-
ExploitServer fetches internal resource (SSRF)
-
ExecutionPivot to internal/metadata services
-
ImpactExfiltrate limited response data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a WordPress site with the StreamCast plugin (version 2.4.5 or earlier) installed and active, and reachability of the vulnerable plugin endpoint from the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or non-default configuration is indicated - unauthenticated remote exploitation against a default plugin installation. The practical value of the SSRF is limited by what internal services, cloud metadata endpoints, or non-public hosts the target WordPress server can actually reach, and by the scope-changed but low (C:L/I:L) impact, meaning it enables internal request forgery and limited data disclosure rather than full compromise. The specific vulnerable parameter or endpoint is not named in the available data. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) describes a network-reachable, low-complexity, unauthenticated flaw with a scope change, which is consistent with a classic CWE-918 SSRF where the vulnerable WordPress server is coerced into making requests to other (internal/subsequent) systems. The raw 7.2 base score is driven largely by the no-authentication/no-interaction requirement plus the scope change, but the impact metrics are modest (C:L/I:L/A:N) - this is information disclosure and limited internal request forgery, not remote code execution. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no confirmed exploitation signal to corroborate the high base score. This should be treated as a genuine but mid-tier priority: unauthenticated and automatable in principle, but limited in direct impact and dependent on what internal services the host WordPress server can reach. EPSS is absent (not low) rather than conflicting; with no KEV and no POC, real-world risk is currently theoretical and should be prioritized behind confirmed-exploited issues but patched promptly given the unauthenticated, no-interaction nature. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a vulnerable endpoint of the StreamCast plugin, supplying an attacker-controlled URL that the WordPress server fetches server-side. This lets the attacker pivot to internal network resources, cloud metadata endpoints, or other services not directly reachable from the internet, and retrieve limited response data. No public exploit code was identified at time of analysis, and low attack complexity means the request can be issued directly without special timing or preconditions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated server-side request forgery in the StreamCast WordPress plugin (versions 2.4.5 and earlier, published by Bplugins) lets a remote attacker coerce the affected WordPress site into issuing attacker-chosen outbound HTTP requests to internal, loopback, or otherwise non-public hosts. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) indicates exploitation requires only network reachability of the plugin endpoint on a default installation - no credentials, no user interaction - with the scope change reflecting impact on systems beyond the WordPress instance itself, though the low confidentiality and integrity ratings mean the practical payoff is internal reconnaissance and limited data disclosure rather than full site compromise. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV); real-world attack value depends heavily on what internal services, control-plane APIs, or cloud metadata endpoints the target web server can actually reach.
RemediationAI
No vendor-released patch is identified in the available data and no exact fixed version is stated; the primary action is to check the Patchstack advisory page (https://patchstack.com/database/wordpress/plugin/streamcast/vulnerability/wordpress-streamcast-plugin-2-4-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve) for a patched StreamCast release and, if none exists, deactivate and remove the StreamCast plugin until an update is published - accepting the loss of streaming functionality as the cost of eliminating the exposure. If the plugin must remain enabled, apply targeted compensating controls: enforce outbound egress filtering on the WordPress host so the web server user cannot initiate connections to loopback, RFC1918 ranges, or the link-local cloud metadata address 169.254.169.254, with the trade-off that any legitimate StreamCast feature that fetches external feeds or embeds from those ranges will break; additionally consider a WAF rule or reverse-proxy rule that blocks requests to the plugin's URL-accepting endpoints when the supplied parameter points to internal or non-HTTP(S) destinations, acknowledging possible false positives on legitimate embedded media. Network-level isolation of the WordPress host in a segmented subnet and, where applicable, enforcing IMDSv2 on AWS-style metadata services reduce the blast radius if SSRF is triggered. Monitor the advisory and the vendor changelog for the exact patched version before re-enabling the plugin.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic CWE-918 Server-Side Request Forgery in a WordPress plugin. StreamCast (CPE cpe:2.3:a:bplugins:streamcast, vendor Bplugins) is a streaming/media plugin for WordPress; per the affected CPE entry the vulnerable code is the plugin component itself across the tracked version range, up to and including 2.4.5. SSRF arises when the plugin accepts a user-supplied URL or host parameter and performs a server-side HTTP request with it without validating the destination scheme, host, or resolved IP address against a deny-list, so an attacker can substitute internal targets such as 127.0.0.1, RFC1918 ranges, or the cloud instance metadata endpoint (169.254.169.254). The CVSS scope value S:C is the key signal: the vulnerable plugin component causes the host to interact with resources in a different security authority, which is exactly the SSRF pattern of pivoting from the reachable web tier into a trusted internal network. C:L/I:L aligns with partial response data being readable by the attacker and limited ability to influence internal requests, rather than code execution or state destruction. Exploitation is unauthenticated per PR:N and requires no user action per UI:N, but the specific vulnerable parameter or endpoint (for example an AJAX action, REST route, or shortcode handler) is not named in the available disclosure data, so defenders should treat the plugin as a whole as the attack surface. The issue was reported and published through Patchstack's WordPress plugin vulnerability database, the standard coordinated-disclosure channel for the WordPress ecosystem.
Know when Streamcast gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network-reachable SSRF with no interaction (AV:N/AC:L/PR:N/UI:N); scope changes as the server attacks other systems (S:C) with limited disclosure and request forgery (C:L/I:L).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.
Executive ViewAI
The StreamCast WordPress plugin (versions 2.4.5 and earlier, published by Bplugins) carries an unauthenticated server-side request forgery flaw that allows any internet-connected party to make affected sites send attacker-chosen requests to internal networks and cloud infrastructure. Because exploitation needs no credentials, no user interaction, and no public exploit code has been identified at time of analysis, exposure is broad and low-effort while no vendor-released patch exists. Leadership should care because an affected site can serve as a foothold for mapping internal services and reaching cloud metadata endpoints, so the risk extends beyond the website to the wider hosting environment.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the StreamCast plugin (versions 2.4.5 and earlier) where it is not business-critical; enforce outbound egress filtering blocking RFC1918, loopback, and link-local/metadata destinations such as 169.254.169.254; require IMDSv2 for cloud instances; limit network reachability to plugin endpoints through WAF rules or access controls; and monitor web server, proxy, and egress logs for requests to internal or metadata addresses.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB