CVE-2026-3712

Name of the Vulnerable Software and Affected Versions PhastPress versions prior to 3.11

Description An issue exists where the scripts service endpoint constructs its URL whitelist dynamically using the Host HTTP header, which can be controlled by an attacker. This allows unauthenticated users to spoof the header to match a target URL, bypassing the whitelist and forcing the server to perform HTTP requests to arbitrary internal or external destinations and return the response content. This is a Server-Side Request Forgery (SSRF), a flaw where a server is tricked into making requests to an unintended location.

Recommendations Update PhastPress to version 3.11 or later.