CVE-2026-0807 PUBLISHED

Frontis Blocks <= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter

Assigner: Wordfence
Reserved: 09.01.2026 Published: 24.01.2026 Updated: 24.01.2026

The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6. This is due to insufficient restriction on the 'url' parameter in the 'template_proxy' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application via the '/template-proxy/' and '/proxy-image/' endpoint.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS Score: 7.2

Product Status

Vendor wpmessiah
Product Frontis Blocks — Block Library for the Block Editor
Versions Default: unaffected
  • affected from * to 1.1.6 (incl.)

Credits

  • Itthidej Aramsri finder
  • Vilaysone CHANTHAVONG finder

References

Problem Types

  • CWE-918 Server-Side Request Forgery (SSRF) CWE