CVE-2022-1398
External Media without Import <= 1.1.2 - Subscriber+ Blind SSRF
MEDIUM 6.5EPSS 3.0%
The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks
- Affected
- External Media without Import
- CVSS v3.1 NVD
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS v2.0 NVD
- 4.0 MEDIUM
AV:N/AC:L/Au:S/C:P/I:N/A:N - EPSS
- 2.98% chance of exploitation in the next 30 days, 87th percentile
- Nuclei
- medium · CWE-918
- Published
- 2022-05-16
- Updated
- 2024-08-03