All in One Social Lite <= 1.0 - Server-Side Request Forgery
Strategic Overview
Vulnerability Overview
The All in One Social Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.0 via the 'ajax-cube3x-stumpleupon-count.php' file. This makes it possible for unauthenticated attackers to gain otherwise restricted information from the vulnerable service and potentially execute malicious code remotely.
Technical Analysis
REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-918 (Server-Side Request Forgery (SSRF)) The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C