PT-2023-18742 · Themeisle · Orbit Fox

Alex Sanford · Published 2023-05-30 · Updated 2025-01-10 · CVE-2023-2287

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Orbit Fox by ThemeIsle WordPress plugin versions prior to 2.10.24

Description The issue allows users to specify arbitrary URLs for the stock photo import feature, leading to a server-side request forgery. This enables users to force the server to access any URL of their choosing.

Recommendations For versions prior to 2.10.24, update to version 2.10.24 or later to resolve the issue. As a temporary workaround, consider restricting access to the stock photo import feature until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2023-2287

Affected Products

Orbit Fox

References · 3

• 🔥 https://wpscan.com/vulnerability/1b36a184-2138-4a65-8940-07e7764669bb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2287 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2287 · Vendor Advisory