Threats tagged 'ghsa-qmv4-fcfm-fvh5'

The Icon List Block plugin for WordPress, up to and including version 1.2.1, contains a Server-Side Request Forgery (SSRF) vulnerability via the fs_api_request function. Authenticated users with Subscriber-level access or higher can exploit this flaw to make arbitrary web requests originating from the web application. The vulnerability allows querying and modifying information from internal services, with responses limited to valid JSON objects.