CVE-2022-2912: Craw Data (WordPress plugin) · Server-Side Request Forgery (SSRF)
Affects Craw Data (WordPress plugin)Source CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 12:54 UTC
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 52% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 16 Sep 2022
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Unknown Craw Data | Affected
| Fixed in– |
AI-suggested
2) If updating is not possible, restrict administrative access to trusted personnel only and enforce strong authentication mechanisms such as multi-factor authentication to reduce the risk of an attacker leveraging an admin session. 3) Educate administrators about phishing and social engineering risks to prevent attackers from tricking them into performing malicious actions. 4) Implement network-level controls such as egress filtering to restrict the server's ability to make arbitrary outbound HTTP requests, limiting the impact of SSRF exploitation. 5) Monitor logs for unusual outbound requests originating from the WordPress server that could indicate exploitation attempts. 6) Conduct regular security audits of WordPress plugins to ensure they follow best practices, including nonce verification for state-changing operations.
Description
The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change the url value performing unwanted crawls on third-party sites (SSRF).