DNS-rebinding SSRF through pingback and URL-details fetches

Summary

WordPress URL validation resolves a host before the request but does not bind the security decision to the eventual connection. A DNS-rebinding hostname can therefore reach an internal address through authenticated URL-details or XML-RPC pingback flows.

Affected Products

WordPress core 7.0.4; HTTP API and XML-RPC/URL-details consumers.

Affected Scope

Product

WordPress

Component

HTTP API URL validation; XML-RPC pingback; URL-details AJAX

Affected function

wp_http_validate_url(); pingback.ping; wp_ajax_url_details; url parameter

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-918

Technical Summary

The validator makes a host/IP decision before the request, but the request path can resolve the hostname again. DNS rebinding can make the validated public name connect to a private or link-local address.

Prerequisites and Permissions

Attacker controls a DNS name and can cause a WordPress server to fetch it; pingback must be enabled for that path. Authenticated URL-details requires the documented logged-in permission.

Affected Locations

wp-includes/http.php: wp_http_validate_url(); XML-RPC pingback.ping; URL-details fetch handler; url input and redirect handling. Exact line numbers vary by build and are not asserted beyond the identified functions.

Reproducible Proof

A controlled rebinding domain was observed receiving the WordPress request and steering the second resolution to an internal test listener. No production metadata or secrets are included.

Vulnerable Code

$response = wp_safe_remote_get( $url, $parsed_args );
if ( is_wp_error( $response ) ) {
	return $response;
}

Severity

high

Technical Analysis

wp_http_validate_url() validates the hostname/IP at one resolution point, while the later HTTP request resolves the attacker-controlled hostname again. The affected callers include pingback.ping and the URL-details fetch path, so a rebinding response can change the destination after validation.

Impact

Confidentiality impact: a remote attacker can induce server-side requests to reachable internal/link-local services. The demonstrated result is blind SSRF in the unauthenticated path and stronger response access only where the caller has the documented authenticated capability. Cloud credentials or a full internal compromise are not claimed.

Remediation

Pin the resolved address or revalidate the actual connected peer; reject private, loopback, link-local, multicast, and reserved ranges after every resolution/redirect; apply the same policy to all callers, including pingback and URL-details.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published
• 2026-09-15Live

Credits

Reported by Aria Akhavan. Disclosure timeline: 2026-08-12 submission; 2026-09-07 follow-up; no response documented by 2026-09-14.