CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Server-Side Request Forgery (SSRF) vulnerability in Rhys Wynne WP eBay Product Feeds ebay-feeds-for-wordpress allows Server Side Request Forgery.This issue affects WP eBay Product Feeds: from n/a through <= 3.4.8.
Explanation of Vulnerability in Simple Terms
WP eBay Product Feeds versions 3.4.8 and earlier contain a server-side request forgery vulnerability. An authenticated attacker with low privileges can make the site send HTTP requests to internal or external systems on their behalf. The scope extends beyond the plugin itself. This requires network access and high attack complexity, but no user interaction.
What an attacker can do
Make the site send HTTP requests to internal systems or external servers on the attacker's behalf.
Potential impact on your site
Attackers with user accounts can probe internal networks, access internal services, or trigger actions on external systems via your site.
Conditions required to exploit
Attacker must have a low-privilege account on the site; network access required.
Key dates
External resources
Related vulnerabilities
