CVE-2025-8085CWE-918ssrf

CVE-2025-8085

High · published September 8, 2025

CVSS v3.1
8.6
EPSS
20%
Percentile
97.5
In the wild
Unconfirmed
What it is

The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.20239 · 97.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-09-08T10:15Z
Affected products (1)
ProductVersionsFixed in
metaphorcreations/ditty< 3.1.583.1.58
References (1)
https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/ · [email protected]
EPSS history
Timeline
  • 08 SEP 06:00Z
    Ditty < 3.1.58 - Unauthenticated SSRF
    cvelistv5