CVE-2026-0807

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0807", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-09T14:24:31.880Z", "datePublished": "2026-01-24T07:26:41.330Z", "dateUpdated": "2026-04-08T16:45:16.150Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:16.150Z"}, "affected": [{"vendor": "wpmessiah", "product": "Frontis Blocks \u2014 Block Library for the Block Editor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6. This is due to insufficient restriction on the 'url' parameter in the 'template_proxy' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application via the '/template-proxy/' and '/proxy-image/' endpoint."}], "title": "Frontis Blocks <= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/322e0a27-9119-4b46-a043-d3a68c4fcdc4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/frontis-blocks/trunk/includes/Admin/Admin.php#L910"}, {"url": "https://plugins.trac.wordpress.org/browser/frontis-blocks/tags/1.1.4/includes/Admin/Admin.php#L910"}, {"url": "https://plugins.trac.wordpress.org/changeset/3444616/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}, {"lang": "en", "type": "finder", "value": "Vilaysone CHANTHAVONG"}], "timeline": [{"time": "2026-01-23T19:20:45.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T15:34:03.787859Z", "id": "CVE-2026-0807", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T15:45:39.333Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0807", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T15:34:03.787859Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T15:34:04.815Z"}}], "cna": {"title": "Frontis Blocks <= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}, {"lang": "en", "type": "finder", "value": "Vilaysone CHANTHAVONG"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpmessiah", "product": "Frontis Blocks \u2014 Block Library for the Block Editor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-23T19:20:45.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/322e0a27-9119-4b46-a043-d3a68c4fcdc4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/frontis-blocks/trunk/includes/Admin/Admin.php#L910"}, {"url": "https://plugins.trac.wordpress.org/browser/frontis-blocks/tags/1.1.4/includes/Admin/Admin.php#L910"}, {"url": "https://plugins.trac.wordpress.org/changeset/3444616/"}], "descriptions": [{"lang": "en", "value": "The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6. This is due to insufficient restriction on the 'url' parameter in the 'template_proxy' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application via the '/template-proxy/' and '/proxy-image/' endpoint."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:16.150Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0807", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:45:16.150Z", "dateReserved": "2026-01-09T14:24:31.880Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-24T07:26:41.330Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Frontis Blocks \u2014 Block Library for the Block Editor", "vendor": "wpmessiah", "versions": [{"lessThanOrEqual": "1.1.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6. This is due to insufficient restriction on the 'url' parameter in the 'template_proxy' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application via the '/template-proxy/' and '/proxy-image/' endpoint."}, {"lang": "es", "value": "El plugin Frontis Blocks para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor en todas las versiones hasta la 1.1.6, inclusive. Esto se debe a una restricci\u00f3n insuficiente en el par\u00e1metro 'url' en la funci\u00f3n 'template_proxy'. Esto permite que atacantes no autenticados realicen peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web a trav\u00e9s del endpoint '/template-proxy/' y '/proxy-image/'."}], "id": "CVE-2026-0807", "lastModified": "2026-06-17T10:11:24.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0807", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T15:34:03.787859Z", "version": "2.0.3"}}]}, "published": "2026-01-24T08:16:07.580", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/frontis-blocks/tags/1.1.4/includes/Admin/Admin.php#L910"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/frontis-blocks/trunk/includes/Admin/Admin.php#L910"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3444616/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/322e0a27-9119-4b46-a043-d3a68c4fcdc4?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T19:06:10.450360+00:00", "value": {"mitigation_remediation": ["Update Frontis Blocks to the latest version (1.1.7 or newer) to eliminate the vulnerable endpoint. ", "Configure the web server or application firewall to block HTTP requests to '/template-proxy/' and '/proxy-image/' for unauthenticated users. ", "If immediate upgrading is not possible, enforce strict whitelisting of allowed URLs for the 'url' parameter and restrict outbound traffic from the host to trusted destinations."], "summary": {"action": "Patch Now", "impact": "Server\u2011Side Request Forgery (SSRF)"}, "threat_synthesis": {"affected_systems": "All installations of the Frontis Blocks WordPress plugin provided by wpmessiah, specifically versions 1.1.6 and earlier. These versions expose the '/template-proxy/' and '/proxy-image/' endpoints that process the vulnerable 'url' parameter without authentication checks.", "description_and_impact": "The vulnerability allows an unauthenticated attacker to supply an arbitrary URL to the 'url' parameter in the ''template_proxy'' function. By doing so, the plugin will send HTTP requests from the host server to any destination resolved from that URL, effectively enabling the attacker to piggyback on the web application to reach internal or external resources. This can expose confidential data, enable phishing or malware delivery, or be used for reconnaissance of internal services. The weakness is identified as CWE-918.", "risk_and_exploitability": "The CVSS score of 7.2 indicates a high severity, while the EPSS score is below 1%, suggesting a low current exploitation probability but still significant due to the high impact. The vulnerability is not listed in CISA\u2019s KEV catalog, but it remains exploitable via simple HTTP requests to the plugin\u2019s endpoints, which require no credentials. Consequently, any WordPress site running an affected version of the plugin is at risk of SSRF without specific mitigation."}}}}, "created": "2026-01-26T11:48:18.276461+00:00", "updated": "2026-04-15T19:15:12.069275+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}