PhastPress vulnerabilities

2 known vulnerabilities in PhastPress from Kiboit. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.3 High severity

  PhastPress: Server-Side Request Forgery

  CVE-2026-3712Oct 15, 2026Kiboit

  The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header.

• 9.8 Critical severity

  PhastPress: Improper Neutralization of Null Byte or NUL Character

  CVE-2025-14388Dec 23, 2025Kiboit

  The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates o