HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-73530 — Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vu...

·Source: NIST NVD

Updated:

Executive Summary

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to ` to bypass the private IP range and blocked hostname checks in `is_private_ip()`,

Analysis

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to ` to bypass the private IP range and blocked hostname checks in `is_private_ip()`, reaching services bound to IPv6 loopback across the `http.get`, `http.request`, and `http.batch` modules. CVSS Score: 7.7. Published: 2026-08-13T20:17:29.590.

Indicators of Compromise (1)

CVE (1)
CVE-2026-73530
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 13, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-15341 — The User Session Synchronizer plugin for WordPress is vulnerable to Authenticati...

The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The `synchronize_session()` function, hooked on `init` and therefore executed on every request, performs no nonce, capability, or shared-secret validation against the attacker-supplied `ussync-key`, `ussync-token`, and `ussync-ref` param

CVE-2026-15341
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-15303 — The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass...

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user

CVE-2026-15303
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-14484 — The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress ...

The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the righ

CVE-2026-14484
NIST NVD