benmoody Content Syndication Toolkit Plugin up to 1.3 on WordPress Proxy Endpoint proxy url server-side request forgery

Summaryinfo

A vulnerability was found in benmoody Content Syndication Toolkit Plugin up to 1.3 on WordPress. It has been classified as critical. The affected element is the function proxy of the component Proxy Endpoint. The manipulation of the argument url leads to server-side request forgery. This vulnerability is traded as CVE-2026-3478. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in benmoody Content Syndication Toolkit Plugin up to 1.3 on WordPress. It has been rated as critical. This issue affects the function proxy of the component Proxy Endpoint. The manipulation of the argument url with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJAX action in the bundled ReduxFramework library. The plugin registers a proxy endpoint (wp_ajax_nopriv_redux_p) that is accessible to unauthenticated users. The proxy() method in the Redux_P class takes a URL directly from $_GET['url'] without any validation (the regex is set to /.*/ which matches all URLs) and passes it to wp_remote_request(), which does not have built-in SSRF protection like wp_safe_remote_request(). There is no authentication check, no nonce verification, and no URL restriction. The response from the requested URL is then returned to the attacker, making this a full-read SSRF. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal network ports, or interact with cloud metadata endpoints.

The weakness was shared by Youcef Hamdani. It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2026-3478 since 03/03/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• benmoody

Name

• Content Syndication Toolkit Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion