JSM file_get_contents() Shortcode < 2.7.1 - Contributor+ SSRF

2023-12-2100:00:00

Dmitrii Ignatyev

jsm file_get_contents shortcode vulnerability ssrf exploit trojan horse wordpress security

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

19.3%

JSON

Description The plugin does not validate one of its shortcode’s parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks.

[wpfgc url="http://127.0.0.1:8084"]