The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.
PoC: fubucker
Automatic Mass Tool for checking vulnerability in CVE-2022-1386 - Fusion Builder < 3.6.2 - Unauthenticated SSRF
PoC: CVE-2022-1386-FusionBuilder-SSRF
Unauthenticated SSRF PoC in WordPress Fusion Builder <3.6.2 (CVE-2022-1386)
PoC: CVE-2022-1386
Fusion Builder < 3.6.2 - Unauthenticated SSRF
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free