WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated administrator can supply a malicious URL via the pluginThemeUrl POST parameter. The server fetches the provided URL using curl_exec() without sufficient validation, allowing the attacker to force internal or external HTTP requests.
References
| Link | Resource |
|---|---|
| https://github.com/thawphone/CVE-2025-57055 | Exploit Mitigation Third Party Advisory |
| https://github.com/thawphone/CVE-2025-57055 | Exploit Mitigation Third Party Advisory |
Configurations
History
23 Sep 2025, 15:44
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/thawphone/CVE-2025-57055 - Exploit, Mitigation, Third Party Advisory | |
| CPE | cpe:2.3:a:wondercms:wondercms:3.5.0:*:*:*:*:*:*:* | |
| First Time |
Wondercms wondercms
Wondercms |
17 Sep 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/thawphone/CVE-2025-57055 - | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-918 |
17 Sep 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-17 15:15
Updated : 2025-09-23 15:44
NVD link : CVE-2025-57055
Mitre link : CVE-2025-57055
CVE.ORG link : CVE-2025-57055
JSON object : View
Products Affected
wondercms
- wondercms
CWE
CWE-918
Server-Side Request Forgery (SSRF)