CVE-2026-3712

{
  "etk_id": "ETK-2026-1898",
  "cve_id": "CVE-2026-3712",
  "display_id": "CVE-2026-3712",
  "ghsa_id": "GHSA-gj56-mwgx-mqvf",
  "euvd_id": "EUVD-2026-101823",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Server-side request forgery in PhastPress for WordPress",
  "summary": "PhastPress for WordPress versions through 3.10 are affected by a server-side request forgery flaw in the scripts service endpoint. An unauthenticated remote attacker may cause the WordPress server to request internal or external resources and return their content when the endpoint is reachable and accepts an attacker-controlled Host header.",
  "mitigation": "Upgrade PhastPress to version 3.11 or later. Until the update is deployed, restrict public access to the affected scripts service endpoint and enforce a trusted Host-header policy at the web server or proxy.",
  "vendor": "kiboit",
  "product": "PhastPress",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.10"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "PhastPress",
      "purl": null
    }
  ],
  "cwes": [
    918
  ],
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "epss_score": 0.0024,
  "epss_percentile": 0.1456,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 38.886387416666665,
  "t0_at": "2026-10-15T04:26:50.177000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-15T04:26:50.177000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T04:26:50.177000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-3712"
    }
  }
}