# StreamCast – bring live radio to your site with a sleek player <= 2.4.6 - Unauthenticated Server-Side Request Forgery via fetch-stream-data AJAX Action

- **ID:** WPSEC-2026-1810
- **Plugin:** StreamCast – bring live radio to your site with a sleek player (`streamcast`), https://wordpress.org/plugins/streamcast/
- **Affected versions:** all versions before 2.4.7
- **Fixed in:** 2.4.7 (Update to 2.4.7 or later.)
- **Severity:** Medium 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
- **Weakness:** CWE-918
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/streamcast
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1810/

## Description

The StreamCast plugin for WordPress is vulnerable to Server-Side Request Forgery via the streamcast_fetch_stream AJAX action in all versions up to, and including, 2.4.6, due to an incomplete fix for CVE-2026-62030. The handler relies on wp_http_validate_url() and wp_safe_remote_get(), which on WordPress versions before 7.1 do not block link-local and cloud metadata addresses (169.254.0.0/16) or carrier-grade NAT addresses (100.64.0.0/10), and which do not check a host's IPv6 (AAAA) addresses; redirect targets are not held to the stream metadata paths the first URL must use. The action is protected only by a nonce given to every visitor of a page that shows the player. This makes it possible for unauthenticated attackers to make the site send web requests to internal addresses, including cloud metadata services, and read the returned response body.

Also published later by wpvulnerability as CVE-2026-62030.

## References

- https://wpsec.com/vuln/WPSEC-2026-1810/
- https://plugins.svn.wordpress.org/streamcast/tags/2.4.7/
- https://wordpress.org/plugins/streamcast/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1810/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.