CVE-2026-0807
Published: 24 January 2026
Summary
CVE-2026-0807 is a high-severity SSRF (CWE-918) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-0807 is a Server-Side Request Forgery (SSRF) vulnerability, classified under CWE-918, affecting the Frontis Blocks plugin for WordPress in all versions up to and including 1.1.6. The issue stems from insufficient restrictions on the 'url' parameter within the 'template_proxy' function, allowing requests to arbitrary locations originating from the web server via the '/template-proxy/' and '/proxy-image/' endpoints. It carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), highlighting its high severity due to network accessibility, low complexity, and changed scope with limited confidentiality and integrity impacts.
Unauthenticated attackers can exploit this vulnerability remotely without privileges or user interaction by sending crafted requests to the affected endpoints. This enables them to force the WordPress server to initiate connections to arbitrary domains or internal resources, potentially bypassing firewalls, accessing metadata services, or probing internal networks from the trusted server context.
Advisories reference code locations in the plugin's Admin.php file at line 910 across version tags and trunk, along with WordPress plugin trac changeset 3444616, which likely addresses the issue post-1.1.6. Additional details are available via Wordfence threat intelligence.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4577
Vulnerability details
The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6. This is due to insufficient restriction on the 'url' parameter in the 'template_proxy' function. This makes it possible for unauthenticated…
more
attackers to make web requests to arbitrary locations originating from the web application via the '/template-proxy/' and '/proxy-image/' endpoint.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in public-facing WordPress plugin directly enables remote exploitation of the application (T1190); description explicitly notes use for accessing cloud metadata services (T1522) and internal network probing/service discovery (T1046).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the 'url' parameter in template_proxy and proxy-image endpoints to reject arbitrary external or internal targets.
Enforces approved information flows so the WordPress server cannot be coerced into initiating SSRF connections to arbitrary destinations.
Boundary protection mechanisms can deny or log unauthorized outbound requests originating from the plugin endpoints to internal or external resources.