The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses.
| Vendor | Product | Versions |
|---|---|---|
| unknown | gallery for social photo | 0 |
Loading…
Updated severity from NONE to CRITICAL and added CWE-918 (Server-Side Request Forgery) classification.
Initial creation
