Description
The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Broken Link Notifier | 1.3.1 – < 2.0.0.1 | 2.0.0.1 |
References
- https://wpscan.com/vulnerability/d9497ddd-c39c-4928-8660-f1c94ef2c3a0/ exploit vdb-entry technical-description