CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Server-Side Request Forgery (SSRF) vulnerability in Oliver Campion Display Remote Posts Block display-remote-posts-block allows Server Side Request Forgery.This issue affects Display Remote Posts Block: from n/a through <= 1.1.0.
Explanation of Vulnerability in Simple Terms
The Display Remote Posts Block plugin for WordPress contains a server-side request forgery vulnerability. An authenticated user with low privileges can make the site send HTTP requests to internal or external systems on the attacker's behalf. This could expose internal services, retrieve sensitive data, or interact with restricted resources. Update to a version newer than 1.1.0.
What an attacker can do
Make the site send HTTP requests to internal or external systems to access restricted resources or retrieve sensitive data.
Potential impact on your site
Attackers with low-privilege accounts can probe internal networks, access internal services, or retrieve data from restricted endpoints.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., contributor or subscriber role).
Key dates
External resources
Related vulnerabilities
