CVE-2023-2287

PoC —

CVSS 3.1

4.3 medium

EPSS

<1%p45

Published

May 30, 2023 (May 30, 2023)

Modified

Jun 17, 2026

Description

The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.

Vendors: themeisle
Products: orbitfox
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.