CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Server-Side Request Forgery (SSRF) vulnerability in Ankur Vishwakarma WP AVCL Automation Helper (formerly WPFlyLeads) woozap allows Server Side Request Forgery.This issue affects WP AVCL Automation Helper (formerly WPFlyLeads): from n/a through <= 3.4.
Explanation of Vulnerability in Simple Terms
WP AVCL Automation Helper versions 3.4 and earlier contain a server-side request forgery vulnerability. An authenticated user with low privileges can make the site send HTTP requests to internal or external systems on the attacker's behalf. The impact is limited to reading non-sensitive data and making minor modifications. Scope is changed, meaning the vulnerability may affect other components or systems.
What an attacker can do
Make the site send HTTP requests to internal systems or external servers on the attacker's behalf.
Potential impact on your site
Attackers with low-privilege accounts can probe internal networks or trigger actions on external systems via your site.
Conditions required to exploit
Attacker must have a low-privilege authenticated account; no user interaction required.
Key dates
External resources
