Description
The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attacks
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics | 8.8.15 – < 8.8.15 | 8.8.15 |