CVE-2026-118422 · Package
NO FIX YET · SEE WHAT TO DO
The Stape Conversion Tracking WordPress plugin before 2.3.11 fails to validate a sub-path on its same-origin proxy, so anyone can make the site's server request arbitrary hosts, including internal ones. The attacker can also get the response returned from the site's own origin with security headers removed, which enables cross-site scripting.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Stape Conversion Tracking WordPress plugin before 2.3.11 are exposed, because its proxy endpoint accepts unauthenticated requests and forwards them without validating the destination. Sites without this plugin installed, or running 2.3.11 or later, are not affected. The sources do not say whether non-default configuration changes exposure.
Not affected if plugin-not-installed, version-2.3.11-or-later
Who cares self-hosted, stape, wordpress
2.3.11 are affected.2.3.11 or later (the fix is stated as the version before which the plugin is vulnerable).The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.
This page as .md · .json · in your agent: get_signal("CVE-2026-118422")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.