Skip to content

Tools Exploits Blog

Tools Exploits Blog

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Feeds Contact Privacy© 2026 Kitploit

Tool Directory

Categories

View all categories

Loading categories

Back to Exploits

CVE-2022-1386

CriticalPublished

Fusion Builder < 3.6.2 - Unauthenticated SSRF

Published: May 16, 2022
Updated: Aug 3, 2024
Assigning CNA: WPScan
Evidence observed: Aug 8, 2026

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

71.4%

High · next 30 days

Percentile: 99.4%
Model date: Oct 17, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

WordPress Fusion Builder <3.6.2 - Server-Side Request ForgeryTemplate
http/cves/2022/CVE-2022-1386.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 17f5725dc10cRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: status,word($.matchers[*].type)

CVE-2022-1386-FusionBuilder-SSRFPoC
Unauthenticated SSRF PoC in WordPress Fusion Builder <3.6.2 (CVE-2022-1386)
fubuckerScanner
Automatic Mass Tool for checking vulnerability in CVE-2022-1386 - Fusion Builder < 3.6.2 - Unauthenticated SSRF
CVE-2022-1386PoC
Fusion Builder < 3.6.2 - Unauthenticated SSRF
CVE-2022-1386PoC
Python proof-of-concept for CVE-2022-1386, an unauthenticated SSRF in Fusion Builder WordPress plugin, demonstrating file read via crafted HTTP requests.
CVE-2022-1386Exploit
Python-based exploit for CVE-2022-1386, providing a ready-to-run script for testing and verifying the vulnerability in affected systems.
CVE-2022-1386-Mass_VulnerabilityExploit

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.