WordPress Plugin Vulnerabilities

FormCraft < 3.9.16 - Unauthenticated Server-Side Request Forgery

Description

The FormCraft plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.9.15. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
formcraft
Fixed in 3.9.16

References

CVE
CVE-2026-65442
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/82f5456e-f2cc-47f3-a957-f85d26834031

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
7.2 (high)

Miscellaneous

Original Researcher
luc
Verified
No
WPVDB ID
a8ce5ff4-dd4c-411c-9b34-7824a75742b6

Timeline

Publicly Published
2026-07-27 (about 12 days ago)
Added
2026-07-30 (about 9 days ago)
Last Updated
2026-07-30 (about 9 days ago)

Other

Published
Title
Published
2026-06-23
Title
utm.codes < 1.9.1 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2025-08-14
Title
B Slider - Gutenberg Slider Block for WP < 2.0.1 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2025-06-12
Title
ProfileGrid < 5.9.5.3 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2024-04-05
Title
RapidLoad Power-Up for Autoptimize < 2.2.12 - Unauthenticated Server-Side Request Forgery
Published
2024-07-22
Title
AI Engine < 2.4.8 - Authenticated (Subscriber+) Server-Side Request Forgery