CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
Server-Side Request Forgery (SSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Server Side Request Forgery.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.1.
Explanation of Vulnerability in Simple Terms
Seriously Simple Podcasting versions up to 3.14.1 contain a server-side request forgery vulnerability. An authenticated administrator can craft requests that cause the plugin to make HTTP calls to internal or external systems on the attacker's behalf. The impact is limited to reading non-sensitive data and making minor modifications. A patch version has not been publicly identified.
What an attacker can do
Make the site send HTTP requests to internal systems or external URLs to read data or trigger actions.
Potential impact on your site
A compromised admin account could be used to probe your internal network or interact with external services without your knowledge.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
