JSM file_get_contents() Shortcode < 2.7.1 - Contributor+ SSRF

2023-12-2100:00:00

Dmitrii Ignatyev

wpscan.com

wordpress

plugin

ssrf

contributor

validation

poc

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

19.3%

JSON

Description The plugin does not validate one of its shortcode’s parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks.

PoC

[wpfgc url=“http://127.0.0.1:8084”]