WordPress Vulnerabilities

WP < 7.0.3 - Unauthenticated Blind SSRF

Description

WordPress does not block requests to all reserved and internal IP address ranges, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services (a blind Server-Side Request Forgery).

Affects WordPress

7.0.2
Fixed in WordPress 7.0.3
7.0.1
Fixed in WordPress 7.0.3
7.0
Fixed in WordPress 7.0.3
6.9.5
Fixed in WordPress 6.9.6
6.9.4
Fixed in WordPress 6.9.6
6.9.3
Fixed in WordPress 6.9.6
6.9.2
Fixed in WordPress 6.9.6
6.9.1
Fixed in WordPress 6.9.6
6.9
Fixed in WordPress 6.9.6
6.8.6
Fixed in WordPress 6.8.7
6.8.5
Fixed in WordPress 6.8.7
6.8.4
Fixed in WordPress 6.8.7
6.8.3
Fixed in WordPress 6.8.7
6.8.2
Fixed in WordPress 6.8.7
6.8.1
Fixed in WordPress 6.8.7
6.8
Fixed in WordPress 6.8.7
6.7.5
Fixed in WordPress 6.7.6
6.7.4
Fixed in WordPress 6.7.6
6.7.3
Fixed in WordPress 6.7.6
6.7.2
Fixed in WordPress 6.7.6
6.7.1
Fixed in WordPress 6.7.6
6.7
Fixed in WordPress 6.7.6
6.6.5
Fixed in WordPress 6.6.6
6.6.4
Fixed in WordPress 6.6.6
6.6.3
Fixed in WordPress 6.6.6
6.6.2
Fixed in WordPress 6.6.6
6.6.1
Fixed in WordPress 6.6.6
6.6
Fixed in WordPress 6.6.6
6.5.8
Fixed in WordPress 6.5.9
6.5.7
Fixed in WordPress 6.5.9
6.5.6
Fixed in WordPress 6.5.9
6.5.5
Fixed in WordPress 6.5.9
6.5.4
Fixed in WordPress 6.5.9
6.5.3
Fixed in WordPress 6.5.9
6.5.2
Fixed in WordPress 6.5.9
6.5
Fixed in WordPress 6.5.9
6.4.8
Fixed in WordPress 6.4.9
6.4.7
Fixed in WordPress 6.4.9
6.4.6
Fixed in WordPress 6.4.9
6.4.5
Fixed in WordPress 6.4.9
6.4.4
Fixed in WordPress 6.4.9
6.4.3
Fixed in WordPress 6.4.9
6.4.2
Fixed in WordPress 6.4.9
6.4.1
Fixed in WordPress 6.4.9
6.4
Fixed in WordPress 6.4.9
6.3.8
Fixed in WordPress 6.3.9
6.3.7
Fixed in WordPress 6.3.9
6.3.6
Fixed in WordPress 6.3.9
6.3.5
Fixed in WordPress 6.3.9
6.3.4
Fixed in WordPress 6.3.9
6.3.3
Fixed in WordPress 6.3.9
6.3.2
Fixed in WordPress 6.3.9
6.3.1
Fixed in WordPress 6.3.9
6.3
Fixed in WordPress 6.3.9
6.2.9
Fixed in WordPress 6.2.10
6.2.8
Fixed in WordPress 6.2.10
6.2.7
Fixed in WordPress 6.2.10
6.2.6
Fixed in WordPress 6.2.10
6.2.5
Fixed in WordPress 6.2.10
6.2.4
Fixed in WordPress 6.2.10
6.2.3
Fixed in WordPress 6.2.10
6.2.2
Fixed in WordPress 6.2.10
6.2.1
Fixed in WordPress 6.2.10
6.2
Fixed in WordPress 6.2.10
6.1.10
Fixed in WordPress 7.0.3
6.1.9
Fixed in WordPress 7.0.3
6.1.8
Fixed in WordPress 7.0.3
6.1.7
Fixed in WordPress 7.0.3
6.1.6
Fixed in WordPress 7.0.3
6.1.5
Fixed in WordPress 7.0.3
6.1.4
Fixed in WordPress 7.0.3
6.1.3
Fixed in WordPress 7.0.3
6.1.2
Fixed in WordPress 7.0.3
6.1.1
Fixed in WordPress 7.0.3
6.1
Fixed in WordPress 7.0.3
6.0.12
Fixed in WordPress 7.0.3
6.0.11
Fixed in WordPress 7.0.3
6.0.10
Fixed in WordPress 7.0.3
6.0.9
Fixed in WordPress 7.0.3
6.0.8
Fixed in WordPress 7.0.3
6.0.7
Fixed in WordPress 7.0.3
6.0.6
Fixed in WordPress 7.0.3
6.0.5
Fixed in WordPress 7.0.3
6.0.4
Fixed in WordPress 7.0.3
6.0.3
Fixed in WordPress 7.0.3
6.0.2
Fixed in WordPress 7.0.3
6.0.1
Fixed in WordPress 7.0.3
6.0
Fixed in WordPress 7.0.3
5.9.13
Fixed in WordPress 7.0.3
5.9.12
Fixed in WordPress 7.0.3
5.9.11
Fixed in WordPress 7.0.3
5.9.10
Fixed in WordPress 7.0.3
5.9.9
Fixed in WordPress 7.0.3
5.9.8
Fixed in WordPress 7.0.3
5.9.7
Fixed in WordPress 7.0.3
5.9.6
Fixed in WordPress 7.0.3
5.9.5
Fixed in WordPress 7.0.3
5.9.4
Fixed in WordPress 7.0.3
5.9.3
Fixed in WordPress 7.0.3
5.9.2
Fixed in WordPress 7.0.3
5.9.1
Fixed in WordPress 7.0.3
5.9
Fixed in WordPress 7.0.3
5.8.13
Fixed in WordPress 7.0.3
5.8.12
Fixed in WordPress 7.0.3
5.8.11
Fixed in WordPress 7.0.3
5.8.10
Fixed in WordPress 7.0.3
5.8.9
Fixed in WordPress 7.0.3
5.8.8
Fixed in WordPress 7.0.3
5.8.7
Fixed in WordPress 7.0.3
5.8.6
Fixed in WordPress 7.0.3
5.8.5
Fixed in WordPress 7.0.3
5.8.4
Fixed in WordPress 7.0.3
5.8.3
Fixed in WordPress 7.0.3
5.8.2
Fixed in WordPress 7.0.3
5.8.1
Fixed in WordPress 7.0.3
5.8
Fixed in WordPress 7.0.3
5.7.15
Fixed in WordPress 7.0.3
5.7.14
Fixed in WordPress 7.0.3
5.7.13
Fixed in WordPress 7.0.3
5.7.12
Fixed in WordPress 7.0.3
5.7.11
Fixed in WordPress 7.0.3
5.7.10
Fixed in WordPress 7.0.3
5.7.9
Fixed in WordPress 7.0.3
5.7.8
Fixed in WordPress 7.0.3
5.7.7
Fixed in WordPress 7.0.3
5.7.6
Fixed in WordPress 7.0.3
5.7.5
Fixed in WordPress 7.0.3
5.7.4
Fixed in WordPress 7.0.3
5.7.3
Fixed in WordPress 7.0.3
5.7.2
Fixed in WordPress 7.0.3
5.7.1
Fixed in WordPress 7.0.3
5.7
Fixed in WordPress 7.0.3
5.6.17
Fixed in WordPress 7.0.3
5.6.16
Fixed in WordPress 7.0.3
5.6.15
Fixed in WordPress 7.0.3
5.6.14
Fixed in WordPress 7.0.3
5.6.13
Fixed in WordPress 7.0.3
5.6.12
Fixed in WordPress 7.0.3
5.6.11
Fixed in WordPress 7.0.3
5.6.10
Fixed in WordPress 7.0.3
5.6.9
Fixed in WordPress 7.0.3
5.6.8
Fixed in WordPress 7.0.3
5.6.7
Fixed in WordPress 7.0.3
5.6.6
Fixed in WordPress 7.0.3
5.6.5
Fixed in WordPress 7.0.3
5.6.4
Fixed in WordPress 7.0.3
5.6.3
Fixed in WordPress 7.0.3
5.6.2
Fixed in WordPress 7.0.3
5.6.1
Fixed in WordPress 7.0.3
5.6
Fixed in WordPress 7.0.3
5.5.18
Fixed in WordPress 7.0.3
5.5.17
Fixed in WordPress 7.0.3
5.5.16
Fixed in WordPress 7.0.3
5.5.15
Fixed in WordPress 7.0.3
5.5.14
Fixed in WordPress 7.0.3
5.5.13
Fixed in WordPress 7.0.3
5.5.12
Fixed in WordPress 7.0.3
5.5.11
Fixed in WordPress 7.0.3
5.5.10
Fixed in WordPress 7.0.3
5.5.9
Fixed in WordPress 7.0.3
5.5.8
Fixed in WordPress 7.0.3
5.5.7
Fixed in WordPress 7.0.3
5.5.6
Fixed in WordPress 7.0.3
5.5.5
Fixed in WordPress 7.0.3
5.5.4
Fixed in WordPress 7.0.3
5.5.3
Fixed in WordPress 7.0.3
5.5.2
Fixed in WordPress 7.0.3
5.5.1
Fixed in WordPress 7.0.3
5.5
Fixed in WordPress 7.0.3
5.4.19
Fixed in WordPress 7.0.3
5.4.18
Fixed in WordPress 7.0.3
5.4.17
Fixed in WordPress 7.0.3
5.4.16
Fixed in WordPress 7.0.3
5.4.15
Fixed in WordPress 7.0.3
5.4.14
Fixed in WordPress 7.0.3
5.4.13
Fixed in WordPress 7.0.3
5.4.12
Fixed in WordPress 7.0.3
5.4.11
Fixed in WordPress 7.0.3
5.4.10
Fixed in WordPress 7.0.3
5.4.9
Fixed in WordPress 7.0.3
5.4.8
Fixed in WordPress 7.0.3
5.4.7
Fixed in WordPress 7.0.3
5.4.6
Fixed in WordPress 7.0.3
5.4.5
Fixed in WordPress 7.0.3
5.4.4
Fixed in WordPress 7.0.3
5.4.3
Fixed in WordPress 7.0.3
5.4.2
Fixed in WordPress 7.0.3
5.4.1
Fixed in WordPress 7.0.3
5.4
Fixed in WordPress 7.0.3
5.3.21
Fixed in WordPress 7.0.3
5.3.20
Fixed in WordPress 7.0.3
5.3.19
Fixed in WordPress 7.0.3
5.3.18
Fixed in WordPress 7.0.3
5.3.17
Fixed in WordPress 7.0.3
5.3.16
Fixed in WordPress 7.0.3
5.3.15
Fixed in WordPress 7.0.3
5.3.14
Fixed in WordPress 7.0.3
5.3.13
Fixed in WordPress 7.0.3
5.3.12
Fixed in WordPress 7.0.3
5.3.11
Fixed in WordPress 7.0.3
5.3.10
Fixed in WordPress 7.0.3
5.3.9
Fixed in WordPress 7.0.3
5.3.8
Fixed in WordPress 7.0.3
5.3.7
Fixed in WordPress 7.0.3
5.3.6
Fixed in WordPress 7.0.3
5.3.5
Fixed in WordPress 7.0.3
5.3.4
Fixed in WordPress 7.0.3
5.3.3
Fixed in WordPress 7.0.3
5.3.2
Fixed in WordPress 7.0.3
5.3.1
Fixed in WordPress 7.0.3
5.3
Fixed in WordPress 7.0.3
5.2.24
Fixed in WordPress 7.0.3
5.2.23
Fixed in WordPress 7.0.3
5.2.22
Fixed in WordPress 7.0.3
5.2.21
Fixed in WordPress 7.0.3
5.2.20
Fixed in WordPress 7.0.3
5.2.19
Fixed in WordPress 7.0.3
5.2.18
Fixed in WordPress 7.0.3
5.2.17
Fixed in WordPress 7.0.3
5.2.16
Fixed in WordPress 7.0.3
5.2.15
Fixed in WordPress 7.0.3
5.2.14
Fixed in WordPress 7.0.3
5.2.13
Fixed in WordPress 7.0.3
5.2.12
Fixed in WordPress 7.0.3
5.2.11
Fixed in WordPress 7.0.3
5.2.10
Fixed in WordPress 7.0.3
5.2.9
Fixed in WordPress 7.0.3
5.2.8
Fixed in WordPress 7.0.3
5.2.7
Fixed in WordPress 7.0.3
5.2.6
Fixed in WordPress 7.0.3
5.2.5
Fixed in WordPress 7.0.3
5.2.4
Fixed in WordPress 7.0.3
5.2.3
Fixed in WordPress 7.0.3
5.2.2
Fixed in WordPress 7.0.3
5.2.1
Fixed in WordPress 7.0.3
5.2
Fixed in WordPress 7.0.3
5.1.22
Fixed in WordPress 7.0.3
5.1.21
Fixed in WordPress 7.0.3
5.1.20
Fixed in WordPress 7.0.3
5.1.19
Fixed in WordPress 7.0.3
5.1.18
Fixed in WordPress 7.0.3
5.1.17
Fixed in WordPress 7.0.3
5.1.16
Fixed in WordPress 7.0.3
5.1.15
Fixed in WordPress 7.0.3
5.1.14
Fixed in WordPress 7.0.3
5.1.13
Fixed in WordPress 7.0.3
5.1.12
Fixed in WordPress 7.0.3
5.1.11
Fixed in WordPress 7.0.3
5.1.10
Fixed in WordPress 7.0.3
5.1.9
Fixed in WordPress 7.0.3
5.1.8
Fixed in WordPress 7.0.3
5.1.7
Fixed in WordPress 7.0.3
5.1.6
Fixed in WordPress 7.0.3
5.1.5
Fixed in WordPress 7.0.3
5.1.4
Fixed in WordPress 7.0.3
5.1.3
Fixed in WordPress 7.0.3
5.1.2
Fixed in WordPress 7.0.3
5.1.1
Fixed in WordPress 7.0.3
5.1
Fixed in WordPress 7.0.3
5.0.25
Fixed in WordPress 7.0.3
5.0.24
Fixed in WordPress 7.0.3
5.0.23
Fixed in WordPress 7.0.3
5.0.22
Fixed in WordPress 7.0.3
5.0.21
Fixed in WordPress 7.0.3
5.0.20
Fixed in WordPress 7.0.3
5.0.19
Fixed in WordPress 7.0.3
5.0.18
Fixed in WordPress 7.0.3
5.0.17
Fixed in WordPress 7.0.3
5.0.16
Fixed in WordPress 7.0.3
5.0.15
Fixed in WordPress 7.0.3
5.0.14
Fixed in WordPress 7.0.3
5.0.13
Fixed in WordPress 7.0.3
5.0.12
Fixed in WordPress 7.0.3
5.0.11
Fixed in WordPress 7.0.3
5.0.10
Fixed in WordPress 7.0.3
5.0.9
Fixed in WordPress 7.0.3
5.0.8
Fixed in WordPress 7.0.3
5.0.7
Fixed in WordPress 7.0.3
5.0.6
Fixed in WordPress 7.0.3
5.0.4
Fixed in WordPress 7.0.3
5.0.3
Fixed in WordPress 7.0.3
5.0.2
Fixed in WordPress 7.0.3
5.0.1
Fixed in WordPress 7.0.3
5.0
Fixed in WordPress 7.0.3
4.9.29
Fixed in WordPress 7.0.3
4.9.28
Fixed in WordPress 7.0.3
4.9.27
Fixed in WordPress 7.0.3
4.9.26
Fixed in WordPress 7.0.3
4.9.25
Fixed in WordPress 7.0.3
4.9.24
Fixed in WordPress 7.0.3
4.9.23
Fixed in WordPress 7.0.3
4.9.22
Fixed in WordPress 7.0.3
4.9.21
Fixed in WordPress 7.0.3
4.9.20
Fixed in WordPress 7.0.3
4.9.19
Fixed in WordPress 7.0.3
4.9.18
Fixed in WordPress 7.0.3
4.9.17
Fixed in WordPress 7.0.3
4.9.16
Fixed in WordPress 7.0.3
4.9.15
Fixed in WordPress 7.0.3
4.9.14
Fixed in WordPress 7.0.3
4.9.13
Fixed in WordPress 7.0.3
4.9.12
Fixed in WordPress 7.0.3
4.9.11
Fixed in WordPress 7.0.3
4.9.10
Fixed in WordPress 7.0.3
4.9.9
Fixed in WordPress 7.0.3
4.9.8
Fixed in WordPress 7.0.3
4.9.7
Fixed in WordPress 7.0.3
4.9.6
Fixed in WordPress 7.0.3
4.9.5
Fixed in WordPress 7.0.3
4.9.4
Fixed in WordPress 7.0.3
4.9.3
Fixed in WordPress 7.0.3
4.9.2
Fixed in WordPress 7.0.3
4.9.1
Fixed in WordPress 7.0.3
4.9
Fixed in WordPress 7.0.3
4.8.28
Fixed in WordPress 7.0.3
4.8.27
Fixed in WordPress 7.0.3
4.8.26
Fixed in WordPress 7.0.3
4.8.25
Fixed in WordPress 7.0.3
4.8.24
Fixed in WordPress 7.0.3
4.8.23
Fixed in WordPress 7.0.3
4.8.22
Fixed in WordPress 7.0.3
4.8.21
Fixed in WordPress 7.0.3
4.8.20
Fixed in WordPress 7.0.3
4.8.19
Fixed in WordPress 7.0.3
4.8.18
Fixed in WordPress 7.0.3
4.8.17
Fixed in WordPress 7.0.3
4.8.16
Fixed in WordPress 7.0.3
4.8.15
Fixed in WordPress 7.0.3
4.8.14
Fixed in WordPress 7.0.3
4.8.13
Fixed in WordPress 7.0.3
4.8.12
Fixed in WordPress 7.0.3
4.8.11
Fixed in WordPress 7.0.3
4.8.10
Fixed in WordPress 7.0.3
4.8.9
Fixed in WordPress 7.0.3
4.8.8
Fixed in WordPress 7.0.3
4.8.7
Fixed in WordPress 7.0.3
4.8.6
Fixed in WordPress 7.0.3
4.8.5
Fixed in WordPress 7.0.3
4.8.4
Fixed in WordPress 7.0.3
4.8.3
Fixed in WordPress 7.0.3
4.8.2
Fixed in WordPress 7.0.3
4.8.1
Fixed in WordPress 7.0.3
4.8
Fixed in WordPress 7.0.3
4.7.33
Fixed in WordPress 7.0.3
4.7.32
Fixed in WordPress 7.0.3
4.7.31
Fixed in WordPress 7.0.3
4.7.30
Fixed in WordPress 7.0.3
4.7.29
Fixed in WordPress 7.0.3
4.7.28
Fixed in WordPress 7.0.3
4.7.27
Fixed in WordPress 7.0.3
4.7.26
Fixed in WordPress 7.0.3
4.7.25
Fixed in WordPress 7.0.3
4.7.24
Fixed in WordPress 7.0.3
4.7.23
Fixed in WordPress 7.0.3
4.7.22
Fixed in WordPress 7.0.3
4.7.21
Fixed in WordPress 7.0.3
4.7.20
Fixed in WordPress 7.0.3
4.7.19
Fixed in WordPress 7.0.3
4.7.18
Fixed in WordPress 7.0.3
4.7.17
Fixed in WordPress 7.0.3
4.7.16
Fixed in WordPress 7.0.3
4.7.15
Fixed in WordPress 7.0.3
4.7.14
Fixed in WordPress 7.0.3
4.7.13
Fixed in WordPress 7.0.3
4.7.12
Fixed in WordPress 7.0.3
4.7.11
Fixed in WordPress 7.0.3
4.7.10
Fixed in WordPress 7.0.3
4.7.9
Fixed in WordPress 7.0.3
4.7.8
Fixed in WordPress 7.0.3
4.7.7
Fixed in WordPress 7.0.3
4.7.6
Fixed in WordPress 7.0.3
4.7.5
Fixed in WordPress 7.0.3
4.7.4
Fixed in WordPress 7.0.3
4.7.3
Fixed in WordPress 7.0.3
4.7.2
Fixed in WordPress 7.0.3
4.7.1
Fixed in WordPress 7.0.3
4.7
Fixed in WordPress 7.0.3

References

URL
https://wordpress.org/news/2026/08/wordpress-7-0-3-release/

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.8 (medium)

Miscellaneous

Original Researcher
Andrew MacPherson
Verified
Yes
WPVDB ID
e1b9918e-1db9-4d95-be44-3241e52946eb

Timeline

Publicly Published
2026-08-06 (about 1 month ago)
Added
2026-08-06 (about 1 month ago)
Last Updated
2026-08-06 (about 1 month ago)

Other

Published
Title
Published
2025-12-24
Title
Link Library < 7.8.8 - Authenticated (Contributor+) Server-Side Request Forgery
Published
2025-12-04
Title
Time Sheets <= 2.1.3 - Use of Known Vulnerable Component
Published
2014-05-28
Title
Jrss Widget <= 1.2 - SSRF
Published
2022-02-28
Title
Formcraft3 < 3.8.28 - Unauthenticated SSRF
Published
2024-05-30
Title
Blocksy Companion < 2.0.43 - Authenticated (Admin+) Server-Side Request Forgery