title: HubSpot < 8.8.15 - Contributor+ Blind SSRF
description: The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attacks
problem types: CWE-918 Server-Side Request Forgery (SSRF)
affected:
{
product: HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics
vendor: Unknown
versions:
lessThan: 8.8.15, status: affected, version: 8.8.15, versionType: custom
}