Server side request forgery (ssrf)

The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF...