CVE-2022-3708: SSRF in WordPress Web Stories Plugin

The SSRF vulnerability in Web Stories allows an attacker, once authenticated within the WordPress site, to craft malicious requests through the /v1/hotlink/proxy endpoint. This bypasses URL validation, enabling the attacker to send requests to internal services that are not directly accessible from the outside. Successful exploitation could lead to information disclosure, modification of internal data, or even potential access to other systems within the same network. The impact is particularly severe because it can be leveraged to scan internal networks and identify vulnerable services, potentially leading to further compromise. This is similar to SSRF vulnerabilities found in other WordPress plugins where internal resources were inadvertently exposed.

1. Reserved2022-10-26
2. Published2022-10-28
3. Modified2025-05-05
4. EPSS updated2026-04-02

The primary mitigation for CVE-2022-3708 is to immediately upgrade the WordPress Web Stories plugin to version 1.25.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block requests to the /v1/hotlink/proxy endpoint or restrict the allowed domains. Additionally, review and restrict the permissions of authenticated users to minimize the potential impact of a successful exploit. Monitor WordPress access logs for unusual outbound requests originating from the plugin.

Active installs

70KKnown

Plugin rating

4.2

Requires WordPress

6.6+

Compatible up to

6.8.5

Requires PHP

7.4+