Migration Backup Restore < 3.5.0 - Admin+ SSRF

2024-05-1000:00:00

Dmitrii Ignatyev

security vulnerability

migration

backup

restore

admin+

ssrf

exploit

poc

may 24 2024

9.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.

1. Click on "Upload Backup" and add http://127.0.0.1:XXX/123.wpstg -> "Upload". 

If the port is open it will return an error "Not Found" to user. If the port isn't open it will return nothing.