StreamCast – bring live radio to your site with a sleek player <= 2.4.6 - Unauthenticated Server-Side Request Forgery via fetch-stream-data AJAX Action
- ID
- WPSEC-2026-1810
- Plugin
- StreamCast – bring live radio to your site with a sleek player (streamcast)
- Affected
- all versions before 2.4.7
- Remediation
- Update to 2.4.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
- Weakness
- CWE-918
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-28
- Attack surface
- StreamCast – bring live radio to your site with a sleek player on WPSec AttackSurface
- Fix released
- Published
Also published later by Wpvulnerability as CVE-2026-62030, on 2026-10-10.
Description
The StreamCast plugin for WordPress is vulnerable to Server-Side Request Forgery via the streamcast_fetch_stream AJAX action in all versions up to, and including, 2.4.6, due to an incomplete fix for CVE-2026-62030. The handler relies on wp_http_validate_url() and wp_safe_remote_get(), which on WordPress versions before 7.1 do not block link-local and cloud metadata addresses (169.254.0.0/16) or carrier-grade NAT addresses (100.64.0.0/10), and which do not check a host's IPv6 (AAAA) addresses; redirect targets are not held to the stream metadata paths the first URL must use. The action is protected only by a nonce given to every visitor of a page that shows the player. This makes it possible for unauthenticated attackers to make the site send web requests to internal addresses, including cloud metadata services, and read the returned response body.
References
- https://wpsec.com/vuln/WPSEC-2026-1810/
- https://plugins.svn.wordpress.org/streamcast/tags/2.4.7/
- https://wordpress.org/plugins/streamcast/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS