Description
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Ditty | < 3.1.58 | 3.1.58 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Ditty < 3.1.58 - Server-Side Request Forgery http/cves/2025/CVE-2025-8085.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/ exploit vdb-entry technical-description