Threats tagged 'ghsa-gj56-mwgx-mqvf'

PhastPress, a WordPress plugin by kiboit, is affected by a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 3.10. The vulnerability arises because the scripts service endpoint dynamically constructs its URL whitelist from the HTTP 'Host' header, which can be manipulated by unauthenticated attackers. This allows attackers to bypass the whitelist and force the server to make HTTP requests to arbitrary internal or external destinations, potentially exposing response content.