CVE-2019-16932 Server-side request forgery in n/a
A blind SSRF vulnerability in the Visualizer WordPress plugin allows attackers to make arbitrary requests via the upload-data endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-16932?
CVE-2019-16932 is a critical server-side request forgery vulnerability in n/a, published on 30 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.
Weakness: CWE-918
Which versions are affected by CVE-2019-16932?
It affects 1 product.
Products include Themeisle Visualizer.
How do I fix CVE-2019-16932?
No fix has been published for CVE-2019-16932 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2019-16932 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-16932 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
- CVE-2022-2444 Visualizer: Tables and Charts Manager for WordPress <= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization
- CVE-2024-35736 WordPress Visualizer plugin <= 3.11.1 - SQL Injection vulnerability
- CVE-2024-27958 WordPress Visualizer plugin <= 3.10.5 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2023-23708 WordPress Visualizer Plugin <= 3.9.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2022-46848 WordPress Visualizer Plugin <= 3.9.1 is vulnerable to Cross Site Scripting (XSS)
Sources
Also known as GHSA-f8jx-jhwh-gq9j.