Orbit Fox < 2.10.24 – Author+ Server-Side Request Forgery | CVE 2023-2287 | Plugin Vulnerabilities

Description

The plugin does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.

Proof of Concept

1. Install the Log HTTP Requests plugin to inspect the requests being sent from the server-side.
2. Open a blog post in the block editor.
3. Click on the "MyStockPhotos" icon in the upper right to open the "MyStockPhotos" sidebar.
4. Hover over an image, click the button to "Add to Media Library", and intercept the request.
5. Change the URL in the `url` POST parameter to an arbitrary URL.
6. Forward the request, and check the HTTP Requests log. See that the server has sent a request to the URL that was chosen.

Affects Plugins

themeisle-companion

Fixed in 2.10.24

References

CVE

Classification

Type

SSRF

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Alex Sanford

Submitter

Alex Sanford

Submitter website

https://wpscan.com

Verified

Yes

WPVDB ID

1b36a184-2138-4a65-8940-07e7764669bb

Timeline

Publicly Published

2023-05-02 (about 2 years ago)

Added

2023-05-02 (about 2 years ago)

Last Updated

2023-05-02 (about 2 years ago)

Other

Published

Title

Published

2024-04-16

Title

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator < 4.4.8 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)

Published

2024-04-12

Title

Wappointment < 2.6.1 - Admin+ SSRF

Published

2025-10-23

Title

Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers < 2.1.5 - Unauthenticated Server-Side Request Forgery

Published

2025-11-26

Title

AI ChatBot with ChatGPT and Content Generator by AYS < 2.7.1 - Unauthenticated Server-Side Request Forgery via 'pinecone_url' Parameter

Published

2025-12-12

Title

Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated < 1.1.0 - Authenticated (Admin+) Server-Side Request Forgery