CVE-2024-27561

HIGH

WonderCMS 3.1.3 - Server-Side Request Forgery via installUpdateThemePluginAction

Title source: llm
STIX 2.1

Description

A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the installThemePlugin parameter.

References (1)

Core 1

Scores

CVSS v3 8.1
EPSS 0.0059
EPSS Percentile 43.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-918
Status published
Products (1)
wondercms/wondercms 3.1.3
Published Mar 05, 2024
Tracked Since Feb 18, 2026