CVE-2026-3712

The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in all versions up to and including 3.10 . The root cause is that the scripts service endpoint dynamically constructs its URL whitelist from the attacker-controlled HTTP 'Host' header . This allows unauthentic...