CVE-2014-8749 BulletProof Security < .51.1 - Server-Side Request Forgery
MediumCVSS 5.0
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ait-pro bulletproof security | <= .51 | No fix listed |
| wordpress bulletproof-security(WordPress) | < .51.1 | .51.1 |
References
- 20141106 Wordpress bulletproof-security <=.51 multiple vulnerabilities mailing-list
- wordpress.org patch vendor-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org