Unscored CVE-2014-8749 EUVD-2014-8580GHSA-gjmw-hpv9-9598

Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPr…

Published Dec 1, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Description

Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter.

References

20141106 Wordpress bulletproof-security <=.51 multiple vulnerabilities mailing-list
https://wordpress.org/plugins/bulletproof-security/changelog/