CVE-2022-1398

PoC —

CVSS 3.1

6.5 medium

EPSS

3%p87

Published

May 16, 2022 (May 16, 2022)

Modified

Jun 17, 2026

Description

The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks

Vendors: external media without import project
Products: external media without import
Ecosystems: WordPress
Weakness: CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (3.1%)

In the news0 stories

No ingested article mentions this CVE yet.