Threats tagged 'ghsa-qmw5-54cp-96w5'

The Local Syndication plugin for WordPress versions up to and including 1.5a contains a Server-Side Request Forgery (SSRF) vulnerability via the `url` parameter in the `[syndicate_local]` shortcode. This vulnerability arises because the plugin uses `wp_remote_get()` instead of the safer `wp_safe_remote_get()`, allowing authenticated users with Contributor-level access or higher to make arbitrary web requests from the server. This can lead to unauthorized access to internal services and network scanning from the web application.