WordPress <= 6.9.1 - Unauthenticated Blind Server-Side Request Forgery via XML-RPC Pingback Discovery

Wordfence Intelligence   >   Vulnerability Database   >   WordPress <= 6.9.1 - Unauthenticated Blind Server-Side Request Forgery via XML-RPC Pingback Discovery
5.8
Server-Side Request Forgery (SSRF)
CVSS 5.8 (Medium)
Publicly Published March 10, 2026
Last Updated March 10, 2026
Researcher sibwtf

Description

WordPress core is vulnerable to Blind Server-Side Request Forgery in all versions up to and including 6.9.1. This is due to the `WP_HTTP_IXR_Client` class using `wp_remote_post()` instead of the safer `wp_safe_remote_post()` when making outgoing XML-RPC pingback requests. This makes it possible for unauthenticated attackers to make web requests to arbitrary internal locations originating from the WordPress server, which can be used to query and modify information from internal services.

References

Share

Vulnerability Details for WordPress

WordPress

Software Type Core
Patched? Yes
Remediation Update to one of the following versions, or a newer patched version: 6.8.4, 6.9.2
Affected Versions
  • 6.8 - 6.8.3
  • 6.9 - 6.9.1
Patched Versions
  • 6.8.4
  • 6.9.2

Recent vulnerabilities in WordPress

WordPress <= 6.9.1 - Cross-Site Scripting via Client-Side Template Override in Admin Area
4.4
CVE ID Unknown
Mar 10, 2026
Researcher: Asaf Mozes
WordPress <= 6.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Navigation Menu Items
4.4
CVE ID Unknown
Mar 10, 2026
Researcher: sibwtf
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
6.5
CVE ID Unknown
Mar 10, 2026
Researcher: Youssef Achtatal
WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API
4.3
CVE-2026-3906
Mar 10, 2026
Researcher: kaminuma
WordPress <= 6.9.1 - Missing Authorization to Authenticated (Author+) Sensitive Information Disclosure via query-attachments AJAX Endpoint
4.3
CVE ID Unknown
Mar 10, 2026
Researcher: Vitaly Simonovich
WordPress <= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure
4.3
CVE-2025-58246
Sep 22, 2025
Researcher: Abu Hurayra (HurayraIIT)
WordPress <= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2025-58674
Sep 22, 2025
Researcher: SavPhill (Savphill)
WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API
6.4
CVE-2024-6307
Jun 24, 2024
Researchers: Alex Concha, Dennis Snell, Grzegorz Ziółkowski, Aaron Jorbin
WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block
6.4
CVE-2024-31111
Jun 24, 2024
Researcher: Rafie Muhammad
WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal
4.3
CVE-2024-32111
Jun 24, 2024
Researchers: apple502j, Rafie Muhammad, Edouard L, David Fifield, x89, mishre
# Title CVE ID CVSS Researchers Date
1 WordPress <= 6.9.1 - Cross-Site Scripting via Client-Side Template Override in Admin Area 4.4 Asaf Mozes March 10, 2026
2 WordPress <= 6.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Navigation Menu Items 4.4 sibwtf March 10, 2026
3 WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload 6.5 Youssef Achtatal March 10, 2026
4 WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API CVE-2026-3906 4.3 kaminuma March 10, 2026
5 WordPress <= 6.9.1 - Missing Authorization to Authenticated (Author+) Sensitive Information Disclosure via query-attachments AJAX Endpoint 4.3 Vitaly Simonovich March 10, 2026
6 WordPress <= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure CVE-2025-58246 4.3 Abu Hurayra (HurayraIIT) September 22, 2025
7 WordPress <= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2025-58674 6.4 SavPhill (Savphill) September 22, 2025
8 WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API CVE-2024-6307 6.4 Alex Concha, Dennis Snell, Grzegorz Ziółkowski, Aaron Jorbin June 24, 2024
9 WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block CVE-2024-31111 6.4 Rafie Muhammad June 24, 2024
10 WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal CVE-2024-32111 4.3 apple502j, Rafie Muhammad, Edouard L, David Fifield, x89, mishre June 24, 2024
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation