CVE-2025-57055

Name of the Vulnerable Software and Affected Versions WonderCMS version 3.5.0

Description WonderCMS version 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated administrator can supply a malicious URL via the pluginThemeUrl POST parameter. The server fetches the provided URL using the curl exec() function without sufficient validation, allowing an attacker to force internal or external HTTP requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.