CVE-2026-78003: Php Wordpress Ssrf Request Array Key As Dynamic Api Path Without Validationcve-2026-78003-php-wordpress-ssrf-request-array-key-as-dynamic-api-path-without-validation
A handler that iterates user-controlled array keys from $_POST/$_GET/$_REQUEST and issues an outbound HTTP/API request with a dynamic URL path does not verify a nonce/capability nor validate the key against a server-side allowlist. PHP preserves '/', '..' and '?' in request array keys, so a key such as "../../routes?x" is interpolated into a relative URL pat
