CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.5.1 via the PassthruLoader::load_image_source function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Explanation of Vulnerability in Simple Terms
The Converter for Media plugin versions up to 6.5.1 contain a server-side request forgery vulnerability. An attacker can make the site send HTTP requests to internal or external systems on the attacker's behalf. The vulnerability requires specific network conditions to exploit but does not require authentication or user interaction. Update to a version newer than 6.5.1.
What an attacker can do
Make the site send HTTP requests to internal or external systems without authorization.
Potential impact on your site
Attackers could probe internal networks, access internal services, or exfiltrate data via the site.
Conditions required to exploit
Network access to the site; specific network conditions required (high attack complexity).
Key dates
External resources
Related vulnerabilities
