CVE-2020-28978: 
WordPress vulnerability analysis and mitigation

The Canto plugin version 1.3.0 for WordPress contains a blind Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2020-28978. The vulnerability was discovered in November 2020 and affects the WordPress plugin Canto. This security flaw allows an unauthenticated attacker to make requests to any internal and external server via the /includes/lib/tree.php?subdomain=SSRF endpoint (NVD, MITRE).

The vulnerability is classified as a Server-Side Request Forgery (SSRF) issue with a CVSS v3.1 base score of 5.3 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is tracked under CWE-918 (Server-Side Request Forgery). To exploit this vulnerability, an attacker must append a question mark (?) to the payload as it acts as a bypass to conduct the attack (GitHub Gist).

The vulnerability allows unauthorized attackers to make server-side requests to both internal and external servers through the affected endpoint. This could potentially lead to information disclosure and access to internal network resources that should not be accessible from the public internet (NVD).

The vulnerability can be exploited by unauthenticated attackers by sending specially crafted requests to the /includes/lib/tree.php endpoint with a manipulated subdomain parameter. The attack requires no special privileges or user interaction, making it relatively easy to exploit (PacketStorm).

The vulnerability has been addressed in subsequent versions of the Canto plugin. Users are advised to upgrade to the latest version of the plugin. The most recent version (3.0.9) includes security fixes for various SSRF vulnerabilities (WordPress Plugin).