CVE-2022-0591observed exploitationCWE-918

CVE-2022-0591: vulnerability in FormCraft

Formcraft3 < 3.8.28 - Unauthenticated SSRF

Published · Updated

Follow this CVE+ Monitor FormCraft

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

65Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 20%
from disclosure to weapon535 days
Published on NVDMar 21
1st PoC+535d
VulnCheck+603d
The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users
Affected products
Unknown · FormCraft
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — FormCraft

In the same product, most dangerous first.

CVE-2023-2592—FormCraft Premium < 3.9.7 - Admin+ SQLiEPSS 0.9%CVE-2023-3501MEDIUMFormCraft < 1.2.7 - Admin+ Stored XSSEPSS 0.5%