- Description
- The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
- Source
- contact@wpscan.com
- NVD status
- Analyzed
- Products
- ditty
CVSS 3.1
- Type
- Secondary
- Base score
- 8.6
- Impact score
- 4
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- Severity
- HIGH
- nvd@nist.gov
- CWE-918
- Hype score
- Not currently trending
CVE-2025-8085: Unauthenticated SSRF in Ditty WordPress Plugin No permission_callback → unauthenticated access. No filtering or sanitization of source_url. wp_remote_get() blindly fetches the attacker-supplied URL. #BugBounty #Wordpress #CyberSecurity https://t.co/HThxKSOEfR
@NullSecurityX
23 Sept 2025
167 Impressions
1 Retweet
5 Likes
1 Bookmark
1 Reply
0 Quotes
CVE-2025-8085 (CVSS:8.6, HIGH) is Awaiting Analysis. The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoi..https://t.co/OIElYSRflR #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
@cracbot
13 Sept 2025
4 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
📱 CVE-2025-8085: SSRF Vulnerability in WordPress Ditty Plugin Exposes Thousands of Sites 🔍 A critical flaw has been identified in the Ditty plugin for WordPress that allows attackers to send arbitrary requests without requiring authentication. https://t.co/3oKUxp8iOn
@tpx_Security
8 Sept 2025
217 Impressions
2 Retweets
5 Likes
0 Bookmarks
0 Replies
0 Quotes
📱 CVE-2025-8085: Vulnerabilidad SSRF en plugin Ditty de WordPress expone miles de sitios 🔍 Se identificó una falla crítica en el plugin Ditty para WordPress que permite a atacantes realizar solicitudes arbitrarias sin necesidad de autenticación. https://t.co/PEKLEDVEvg
@tpx_Security
8 Sept 2025
205 Impressions
2 Retweets
3 Likes
1 Bookmark
0 Replies
0 Quotes
🚨 New Research Alert! 🚨 CVE-2025-8085 – Unauthenticated SSRF in the WordPress Ditty plugin could allow attackers to pivot through your server into internal networks! Dive deep into the technical analysis and PoC here 👇 🔗 https://t.co/HThxKSPc5p #WordPress #SSRF #
@NullSecurityX
8 Sept 2025
922 Impressions
3 Retweets
20 Likes
7 Bookmarks
0 Replies
1 Quote
CVE-2025-8085: SSRF in Ditty WordPress plugin, 8.6 rating❗️ The vulnerability allows attackers without authentication to make requests to arbitrary URLs. Search at https://t.co/hv7QKSr5Jp: 👉 Link: https://t.co/Ch7nLlneQj https://t.co/oGYJ8Tel9s
@Netlas_io
8 Sept 2025
110 Impressions
0 Retweets
0 Likes
1 Bookmark
0 Replies
0 Quotes
CVE-2025-8085 Unauthenticated URL Request Vulnerability in Ditty WordPress Plugin Before 3.1.58 https://t.co/8b0NgbSnZn
@VulmonFeeds
8 Sept 2025
723 Impressions
1 Retweet
1 Like
0 Bookmarks
2 Replies
0 Quotes
CVE-2025-8085 The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make re… https://t.co/fEjAG6ZfUK
@CVEnew
8 Sept 2025
395 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 CVE-2025-8085: Unauthenticated SSRF in Ditty WordPress plugin lets anyone make your server fetch internal URLs. Patch to 3.1.58+ now! Full advisory ➡️ https://t.co/wfytyUEGLV #WordPress #infosec #AppSec
@VolerionSec
8 Sept 2025
36 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:metaphorcreations:ditty:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "1D372318-0FD2-4BBB-A63F-E73289182D25",
"versionEndExcluding": "3.1.58",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]