CVE-2022-0591: Formcraft3 < 3.8.28 - Unauthenticated SSRF

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 20.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-21 · updated 2026-06-17
Weakness: CWE-918

Description

The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users

Affected products

Subtlewebinc Formcraft3: before 3.8.28 — fixed in 3.8.28

How to fix

Upgrade to a fixed version: Subtlewebinc Formcraft3 3.8.28. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/b5303e63-d640-4178-9237-d0f524b13d47
https://wpscan.com/vulnerability/b5303e63-d640-4178-9237-d0f524b13d47

Get alerted when CVE-2022-0591 or the next vulnerability affects your stack