CVE-2017-16870

High

Published: 17/11/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The UpdraftPlus plugin for WordPress through version 1.13.12 has an SSRF vulnerability in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction.

Risk Assessment

This vulnerability may allow attackers to access internal network resources; however, the vendor reports that it does not cross a privilege boundary.

Recommendation

It is recommended to update the UpdraftPlus plugin to the latest version to mitigate this vulnerability.

Other vulnerabilities in UpdraftPlus plugin for WordPress

CVE-2017-16871High
The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution due to a race condition in the plupload_action function in /wp-content/plugins/updraftplus/admin.php before deleting a file associated with the name parameter.

Original NVD description (English source)

The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary

Vulnerability data from NVD (NIST) · CISA KEV · EPSS