CVE-2025-8085

The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:metaphorcreations:ditty:*:*:*:*:*:wordpress:*:*

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) El plugin de WordPress Ditty anterior a la versión 3.1.58 carece de autorización y autenticación para las solicitudes a su endpoint displayItems, lo que permite a los visitantes no autenticados realizar solicitudes a URL arbitrarias.

Information

Published : 2025-09-08 06:15

Updated : 2026-09-30 23:10

NVD link : CVE-2025-8085

Mitre link : CVE-2025-8085

CVE.ORG link : CVE-2025-8085

JSON object : View

Products Affected

metaphorcreations

ditty

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2025-8085", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8085", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-08T18:17:20.431400Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "Ditty", "versions": [{"status": "affected", "version": "0", "lessThan": "3.1.58", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-08T06:15:34.833", "references": [{"url": "https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs."}, {"lang": "es", "value": "El plugin de WordPress Ditty anterior a la versi\u00f3n 3.1.58 carece de autorizaci\u00f3n y autenticaci\u00f3n para las solicitudes a su endpoint displayItems, lo que permite a los visitantes no autenticados realizar solicitudes a URL arbitrarias."}], "lastModified": "2026-09-30T23:10:00.237", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:metaphorcreations:ditty:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "1D372318-0FD2-4BBB-A63F-E73289182D25", "versionEndExcluding": "3.1.58"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}