.. / CVE-2021-25074

• Open Redirect
• Nuclei
• Web

Exploit for WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect (CVE-2021-25074)

Description:

WordPress WebP Converter for Media < 4.0.3 contains a file (passthru.php) which does not validate the src parameter before redirecting the user to it, leading to an open redirect issue.

Nuclei Template

View the template here CVE-2021-25074.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-25074.yaml

References: