CVE-2022-3590

Deeper analysis

WordPress contains an unauthenticated blind server-side request forgery vulnerability in its pingback feature. The flaw stems from a time-of-check to time-of-use race condition that occurs between the code validating outbound requests and the actual HTTP request itself, allowing an attacker to reach internal hosts that the application is explicitly configured to block. The affected component is the core WordPress pingback implementation, rated at CVSS 5.9 with network attack vector, high complexity, and no required privileges or user interaction.

An unauthenticated remote attacker can exploit the race condition to perform blind SSRF against internal systems, resulting in high confidentiality impact while integrity and availability remain unaffected. The attack requires the target WordPress site to have pingbacks enabled and depends on winning the TOCTOU window, which limits reliability but removes the need for authentication or special positioning.

Public analysis published by SonarSource and tracked by WPScan describes the bypass technique in detail. The EPSS score currently stands at 0.9031 with a recorded peak of 0.9158, indicating sustained exploitation interest after disclosure.