Description
Ditty WordPress插件是一款用于创建新闻滚动条和内容展示的WordPress插件。该插件在其 displayItems 端点的请求中缺乏授权和身份验证，允许未经身份验证的访客向任意 URL 发起请求。v3.1.57 尝试通过 nonce 检查修复该问题，但任何已认证用户，例如订阅者，仍可以获取它。
WordPress Ditty /wp-json/dittyeditor/v1/displayItems 服务器端请求伪造漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.ionix.io/blog/unauthenticated-ssrf-in-ditty-wordpress-plugin-cve-2025-8085/
https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/
https://research.cleantalk.org/cve-2025-8085/
https://patchstack.com/database/wordpress/plugin/ditty-news-ticker/vulnerability/wordpress-ditty-plugin-3-1-58-unauthenticated-ssrf-vulnerability
https://www.cve.org/CVERecord?id=CVE-2025-8085
https://www.cvedetails.com/cve/CVE-2025-8085/
https://www.sentinelone.com/vulnerability-database/cve-2025-8085/
https://www.rapid7.com/db/vulnerabilities/ditty-news-ticker-plugin-cve-2025-8085/
https://radar.offseq.com/threat/cve-2025-8085-cwe-918-server-side-request-forgery--f2d7ca4d
https://pentest-tools.com/vulnerabilities-exploits/ditty-3158-server-side-request-forgery_27647