The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP
WordPress
SSRF
Rsvpmaker
Carrcommunications
NVD
WPScan
CVSS 3.1
2.7
EPSS
1.0%