CVE-2021-39339
MEDIUMTelefication < 1.8.0 - Server-Side Request Forgery via bypass.php
Title source: llmDescription
The Telefication WordPress plugin is vulnerable to Open Proxy and Server-Side Request Forgery via the ~/bypass.php file due to a user-supplied URL request value that gets called by a curl requests. This affects versions up to, and including, 1.8.0.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_misc
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39339
Third Party Advisory x_refsource_misc
https://plugins.trac.wordpress.org/browser/telefication/tags/1.8.0/bypass.php
Scores
CVSS v3
5.8
EPSS
0.0133
EPSS Percentile
67.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-918
Status
published
Products (1)
telefication/telefication
< 1.8.0
Published
Sep 22, 2021
Tracked Since
Feb 18, 2026