eric/apprise-wordpress-notifications
Watch
1
0
Fork
You've already forked apprise-wordpress-notifications
 0
Code Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions
3 releases 21 tags
  • 2.5.3 0beb9b9c3d

    2.5.3 Stable

    eric released this 2026-06-28 09:42:33 -07:00 | 2 commits to main since this release

    Security

    • Block CURLOPT_URL in sanitize_curl_options() — CURLOPT_URL (integer 10002) was absent from the cURL option blocklist. A rogue plugin hooking apprise_notifications_request_args could inject this option to redirect any Apprise API request to an arbitrary URL after SSRF validation had already passed. The CURLOPT_RESOLVE DNS pin applied to the original Apprise hostname has no effect on a substituted target, so loopback services, RFC 1918 hosts, and cloud metadata endpoints (e.g. 169.254.169.254) were reachable. Exploitation requires server-side code execution via a malicious or compromised plugin.

    Full changelog: 2.5.2...2.5.3

    Downloads