CVE-2026-7025

Typecho up to 1.3.0 is affected by a server-side request forgery in the Ping Back Service Endpoint: the function Service::sendPingHandle (var/Widget/Service.php). The X-Pingback/link parameter manipulation triggers SSRF, enabling remote access. Exploit publicly available; vendor not responsive to...