CVE-2023-2287 – Orbit Fox < 2.10.24 - Author+ Server-Side Request Forgery

https://notcve.org/view.php?id=CVE-2023-2287

The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing. The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 2.10.23 via the parse_request function. This can allow authenticated attackers with the upload_files capability, like authors and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. • https://wpscan.com/vulnerability/1b36a184-2138-4a65-8940-07e7764669bb • CWE-918: Server-Side Request Forgery (SSRF) •