Description
3.1.58 之前的 Ditty WordPress 插件缺乏对其 displayItems 端点请求的授权和身份验证，允许未经身份验证的访问者向任意 URL发出请求。
WordPress Ditty 存在 SSRF 漏洞（CVE-2025-8085）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-8085
https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/
https://www.ionix.io/blog/unauthenticated-ssrf-in-ditty-wordpress-plugin-cve-2025-8085/
https://research.cleantalk.org/cve-2025-8085/
https://www.sentinelone.com/vulnerability-database/cve-2025-8085/
https://www.rapid7.com/db/vulnerabilities/ditty-news-ticker-plugin-cve-2025-8085/
https://www.tenable.com/cve/CVE-2025-8085
https://github.com/advisories/GHSA-5w55-fgg7-m5gx
https://patchstack.com/database/wordpress/plugin/ditty-news-ticker/vulnerability/wordpress-ditty-plugin-3-1-58-unauthenticated-ssrf-vulnerability
https://cve.imfht.com/detail/CVE-2025-8085