CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the request() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Explanation of Vulnerability in Simple Terms
Snow Monkey contains a server-side request forgery vulnerability that allows an attacker to make the site send HTTP requests to internal or external systems on the attacker's behalf. The vulnerability requires specific network conditions to exploit but can leak sensitive information or modify data on systems the site can reach. No user interaction is required.
What an attacker can do
Make the site send HTTP requests to internal systems or external servers to read data or trigger actions.
Potential impact on your site
Attackers could access internal services, leak credentials, or modify data on systems your site can reach.
Conditions required to exploit
Network access to the site; specific network conditions must be present (high attack complexity).
Key dates
External resources
Related vulnerabilities
