Vulnerability · Published Mar 21, 2022 · Assigned by WPScan
CVE-2022-0591Formcraft3 < 3.8.28 - Unauthenticated SSRF
Critical 9.1
In plain English
A critical-severity server-side request forgery in FormCraft from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 20.2% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)20.2%top 2.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Nuclei, Public PoC
Official description
The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users
Affected products (as reported)
Weakness: CWE-918