EUVD-2026-60912
GHSA-8q96-xvg6-h5cm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Network-reachable unauthenticated endpoint with no complexity; S:C and C:L/I:L reflect SSRF reaching internal systems with partial data read and request injection capability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.
AnalysisAI
Unauthenticated SSRF in OttoKit WordPress plugin (≤1.1.35) allows any remote attacker without credentials to coerce the host server into making arbitrary outbound HTTP requests to attacker-controlled targets, including internal network resources and cloud metadata endpoints. The CVSS S:C (Scope Changed) rating confirms the vulnerability crosses security boundaries beyond the WordPress instance itself, enabling internal network reconnaissance, credential harvesting from cloud metadata services (e.g., AWS IMDSv1), or interaction with internal APIs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS PR:N confirms the vulnerable endpoint is accessible without credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The real-world risk is elevated despite the moderate-high CVSS score of 7.2. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote, unauthenticated attacker sends a crafted HTTP POST request to a publicly accessible OttoKit REST API or webhook endpoint, embedding a malicious URL (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/) in a parameter that OttoKit passes to an outbound HTTP function. The WordPress server fetches the attacker-specified URL and, depending on the response handling, returns response data or metadata to the attacker, enabling cloud credential theft or internal network mapping. … |
| Remediation | The primary remediation is to update OttoKit to a version released after 1.1.35. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Disable or uninstall OttoKit plugin version 1.1.35 and earlier on all WordPress instances via the admin dashboard and verify removal; audit server logs for suspicious outbound HTTP requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and to 169.254.169.254. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated PHP Object Injection in the OttoKit WordPress plugin (formerly SureTriggers) versions 1.1.27 and earlier
Blind SQL injection in Brainstorm Force OttoKit (WordPress plugin suretriggers) versions up to 1.1.20 allows privileged
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today