CVE-2025-8085: Ditty < 3.1.58 - Unauthenticated SSRF
Published Sep 8, 2025
·Updated
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
Affected Software
2 affected components
Ditty Ditty WordPress plugin<3.1.58
metaphorcreations Ditty Wordpress<3.1.58
Event History
Sep 8, 2025
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-8085?
CVE-2025-8085 is considered a critical vulnerability due to its potential for unauthenticated remote access.
2
How do I fix CVE-2025-8085?
To fix CVE-2025-8085, update the Ditty WordPress plugin to version 3.1.58 or later.
3
What are the risks associated with CVE-2025-8085?
The risks include exposure to unauthorized access, data leakage, and potential exploitation through arbitrary URL requests.
4
What versions are affected by CVE-2025-8085?
CVE-2025-8085 affects all versions of the Ditty WordPress plugin before 3.1.58.
5
Can CVE-2025-8085 be exploited by unauthenticated users?
Yes, CVE-2025-8085 allows unauthenticated users to make requests to arbitrary URLs through the vulnerable endpoint.