Description
The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | External Media without Import | 1.1.2 – ≤ 1.1.2 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery http/cves/2022/CVE-2022-1398.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.