Description (CNA)
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WordPress / WordPress | affected 4.1.30 through 6.1.1 |
CWE
No CWE identifiers supplied.
References
- https://wpscan.com/vulnerability/c8814e6e-78b3-4f63-a1d3-6906a84c1f11
- https://blog.sonarsource.com/wordpress-core-unauthenticated-blind-ssrf/
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.