CVE-2025-8085

Ditty < 3.1.58 - Unauthenticated SSRF

The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.

Affected

Ditty

CVSS v3.1 CNA

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

20.24% chance of exploitation in the next 30 days, 97th percentile

Nuclei

high

Published

2025-09-08

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8085.yaml

Security advisories

• https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff

References

• CVE Record
• NVD entry