CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Server-Side Request Forgery (SSRF) vulnerability in mra13 Compact WP Audio Player compact-wp-audio-player allows Server Side Request Forgery.This issue affects Compact WP Audio Player: from n/a through <= 1.9.14.
Explanation of Vulnerability in Simple Terms
Compact WP Audio Player versions 1.9.14 and earlier contain a server-side request forgery vulnerability. An authenticated user with low privileges can make the site send HTTP requests to internal or external systems on the attacker's behalf. The vulnerability affects confidentiality and integrity but not availability. Update to a version newer than 1.9.14.
What an attacker can do
Make the site send HTTP requests to internal systems or external URLs under the attacker's control.
Potential impact on your site
Attackers with user accounts can probe internal infrastructure, access internal services, or trigger actions on external systems.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the site.
Key dates
External resources
Related vulnerabilities
