{
 "id": "WPSEC-2026-1810",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1810/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1810/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1810/index.md",
 "title": "StreamCast – bring live radio to your site with a sleek player <= 2.4.6 - Unauthenticated Server-Side Request Forgery via fetch-stream-data AJAX Action",
 "description": "The StreamCast plugin for WordPress is vulnerable to Server-Side Request Forgery via the streamcast_fetch_stream AJAX action in all versions up to, and including, 2.4.6, due to an incomplete fix for CVE-2026-62030. The handler relies on wp_http_validate_url() and wp_safe_remote_get(), which on WordPress versions before 7.1 do not block link-local and cloud metadata addresses (169.254.0.0/16) or carrier-grade NAT addresses (100.64.0.0/10), and which do not check a host's IPv6 (AAAA) addresses; redirect targets are not held to the stream metadata paths the first URL must use. The action is protected only by a nonce given to every visitor of a page that shows the player. This makes it possible for unauthenticated attackers to make the site send web requests to internal addresses, including cloud metadata services, and read the returned response body.",
 "plugin": {
  "slug": "streamcast",
  "name": "StreamCast – bring live radio to your site with a sleek player",
  "full_name": "StreamCast – bring live radio to your site with a sleek player",
  "wordpress_org": "https://wordpress.org/plugins/streamcast/",
  "advisories_url": "https://wpsec.com/vuln/plugin/streamcast/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/streamcast"
 },
 "type": "SSRF",
 "cwe": [
  "CWE-918"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.4.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.4.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.4.7",
 "remediation": "Update to 2.4.7 or later.",
 "fix_released": "2026-10-27T06:08:19+00:00",
 "published": "2026-10-28T06:42:37+00:00",
 "updated": "2026-10-27T13:40:38.771867+00:00",
 "also_published_as": {
  "source": "wpvulnerability",
  "cve": [
   "CVE-2026-62030"
  ],
  "published": "2026-10-10T00:00:00+00:00"
 },
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1810/",
  "https://plugins.svn.wordpress.org/streamcast/tags/2.4.7/",
  "https://wordpress.org/plugins/streamcast/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/streamcast",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-28"
 }
}