CVE-2022-0591

CVE-2022-0591: Formcraft3 < 3.8.28 - Unauthenticated SSRF

Vendor Unknown

Product FormCraft

Weakness CWE-918 · SSRF

Published March 21, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users

Key dates

02Disclosure timeline

March 21, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-0591 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/918.html

Related vulnerabilities

04Related CVE

CVE-2026-39362 InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs CVE-2026-2711 zhutoutoutousan worldquant-miner URL ssrf_proxy.py server-side request forgery CVE-2025-42988 Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform CVE-2023-26366 Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918) CVE-2026-27567 Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads