CVE-2026-3478 is a Server-Side Request Forgery vulnerability in the Content Syndication Toolkit WordPress plugin (up to version 1.3). The vulnerability exists in the redux_p AJAX action implemented in the bundled ReduxFramework library. The plugin exposes a proxy endpoint (wp_ajax_nopriv_redux_p) accessible without authentication or nonce verification. The proxy() method directly uses a URL parameter from user input without validation and forwards it using wp_remote_request(), which lacks SSRF protections. This allows unauthenticated attackers to make arbitrary HTTP requests from the server, potentially accessing internal network resources or cloud metadata services.

An unauthenticated attacker can exploit this vulnerability to perform SSRF attacks, enabling them to read data from internal services, scan internal network ports, or interact with cloud metadata endpoints. This can lead to information disclosure and potentially facilitate further attacks within the internal network. The CVSS 3.1 base score of 7.2 reflects high severity with low attack complexity, no privileges required, and impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable AJAX endpoint if possible. Monitoring for unusual outbound requests originating from the server may help detect exploitation attempts. Avoid exposing the plugin on publicly accessible sites without additional protective controls.