VDB
CVE-2025-8085
CVE-2025-8085
PUBLISHED
KEV
CVSS 8.600000381469727 HIGH
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
EPSS 20.24% · 97.4th percentile
Risk Scores
CVSS 3.1
8.600000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS Score
20.24%
97.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Ditty | 0 |
| metaphorcreations | ditty | 0 |
Timeline
- Sep 8, 2025 EPSS Score
- Sep 8, 2025 CVE Published
- Sep 8, 2025 CVE Updated
- Sep 8, 2025 PoC Published
- Sep 10, 2025 PoC Published
- Sep 11, 2025 PoC Published
- Sep 11, 2025 PoC Published
- Sep 14, 2025 EPSS Score
- Sep 16, 2025 EPSS Score
- Oct 1, 2025 EPSS Score
- Oct 10, 2025 EPSS Score
- Oct 17, 2025 EPSS Score