Assistant – Every Day Productivity Apps, 276a67044e9badbdac5a71b473bf0870347b6461
- CVE, Research URL
- Application
- Published on
- Jul 27, 2023
- Research Description
- Assistant – Every Day Productivity Apps [assistant] < 1.4.4 Assistant <= 1.4.3 - Authenticated (Editor+) Server Side Request Forgery The Assistant plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.4.3 via the /posts/(?P<id>\d+)/library/(?P<library_id>\d+) REST API endpoint. This can allow authenticated attackers, with editor-level capabilities and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Affected versions
-
Min -, max 1.4.4.
- Status
-
vulnerable