CVE-2022-1398

The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

EPSS

3.05% chance of exploitation in the next 30 days, 87th percentile

Nuclei

medium · CWE-918

Published

2022-05-16

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/5440d177-e995-403e-b2c9-42ceda14579e

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1398.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-1397
• CVE-2022-1407
• CVE-2022-1396
• CVE-2022-1408
• CVE-2022-1395
• CVE-2022-1409