Aotuman Grab Wechat Articles
Monthly
Server-Side Request Forgery in the Aotuman Grab WeChat Articles WordPress plugin (versions <= 2.0.1) allows low-privileged authenticated users at the subscriber role to force the WordPress server to issue arbitrary HTTP requests to attacker-controlled destinations, including internal network hosts. The CVSS Scope:Changed metric confirms the vulnerability can reach resources outside the WordPress application boundary, such as cloud metadata endpoints or internal services. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Server-Side Request Forgery in the Aotuman Grab WeChat Articles WordPress plugin (versions <= 2.0.1) allows low-privileged authenticated users at the subscriber role to force the WordPress server to issue arbitrary HTTP requests to attacker-controlled destinations, including internal network hosts. The CVSS Scope:Changed metric confirms the vulnerability can reach resources outside the WordPress application boundary, such as cloud metadata endpoints or internal services. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.