PT-2022-13858 · WordPress · External Media Without Import

Luan Pedersini · Published 2022-05-16 · Updated 2022-05-24 · CVE-2022-1398

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions External Media without Import WordPress plugin versions 1.1.2 and earlier

Description The issue allows any authenticated users to perform blind SSRF attacks due to the lack of authorization and validation of media sources. This could potentially enable attackers to access internal resources.

Recommendations For External Media without Import WordPress plugin versions 1.1.2 and earlier, update to a version that includes proper authorization and validation of media sources to prevent blind SSRF attacks.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-1398

Affected Products

External Media Without Import

References · 3

• 🔥 https://wpscan.com/vulnerability/5440d177-e995-403e-b2c9-42ceda14579e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1398 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1398 · Vendor Advisory