WordPress Plugin Vulnerabilities
Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated SSRF
Description
The plugin lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
Proof of Concept
Affects Plugins
No known fix References
CVE
Classification
Type
SSRF
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Aly Khaled
Submitter
Aly Khaled
Submitter website
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2025-03-04 (about 10 months ago)
Added
2025-03-04 (about 10 months ago)
Last Updated
2025-03-04 (about 10 months ago)
WPScan 