PT-2026-28271 · WordPress · Oxygen Theme For Wordpress
CVE-2025-12886
·
Publicado
2026-03-28
·
Atualizado
2026-03-28
CVSS v3.1
7.2
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Oxygen Theme for WordPress versions up to and including 6.0.8
Description
The Oxygen Theme for WordPress is susceptible to Server-Side Request Forgery (SSRF) through the
laborator calc route AJAX action. This allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application, potentially enabling them to query and modify information from internal services. The issue is triggered via the route path parameter.Recommendations
Update Oxygen Theme for WordPress to a version later than 6.0.8.
Correção
SSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Oxygen Theme For Wordpress