What is CVE-2023-2287?

CVE-2023-2287 is a medium-severity vulnerability in Themeisle Orbitfox, classified under CWE-918 SERVER-SIDE REQUEST FORGERY (SSRF). CVSS score: 4.3/10. Published 2023-05-30.

How severe is CVE-2023-2287?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2023-2287 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Themeisle Orbitfox

CVE-2023-2287

The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.

EPSS: 0.006 (43.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Themeisle Orbitfox
Unknown Orbit Fox By Themeisle — versions 0

Public proof-of-concept exploits

20142995/nuclei-templates

References

contact@wpscan.com (Exploit, technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2023-2287?: CVE-2023-2287 is a medium-severity vulnerability in Themeisle Orbitfox, classified under CWE-918 SERVER-SIDE REQUEST FORGERY (SSRF). CVSS score: 4.3/10. Published 2023-05-30.
How severe is CVE-2023-2287?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2023-2287 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.