The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.
canto canto 1.3.0