CVE-2023-5974 PoC — WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5974.yaml

Associated Vulnerability

Title:WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery (CVE-2023-5974)
Description:The WPB Show Core WordPress plugin through 2.2 is vulnerable to server-side request forgery (SSRF) via the `path` parameter.

Description

The WPB Show Core WordPress plugin through version 2.2 is vulnerable to Server-Side Request Forgery (SSRF) via the 'path' parameter in the download-file.php script. This vulnerability allows unauthenticated attackers to make the server perform requests to arbitrary URLs.

File Snapshot

Log in to view the POC file snapshot cached by Shenlong Bot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →