WordPress Plugin Vulnerabilities

CommentLuv <= 4 - Unauthenticated SSRF

Description

The plugin is vulnerable to Server-Side Request Forgery via the do_click function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
commentluv
No known fix

References

CVE
CVE-2023-49159
URL
https://patchstack.com/database/vulnerability/commentluv/wordpress-commentluv-plugin-3-0-4-server-side-request-forgery-ssrf-vulnerability

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Yuchen Ji
Verified
No
WPVDB ID
7b61c89c-5287-4443-a2c1-24e94cef5c01

Timeline

Publicly Published
2023-11-28 (about 2 years ago)
Added
2023-12-08 (about 2 years ago)
Last Updated
2024-01-10 (about 2 years ago)

Other

Published
Title
Published
2026-01-09
Title
Featured Image from URL (FIFU) < 5.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url'
Published
2025-01-03
Title
Course Migration for LearnDash <= 1.0.2 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2026-02-04
Title
All In One Image Viewer Block < 1.0.3 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint
Published
2025-03-11
Title
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin < 6.3 - Authenticated (Admin+) Server-Side Request Forgery via Webhook
Published
2025-04-01
Title
WP Optin Wheel < 1.4.8 - Admin+ SSRF