CVE-2024-0628
published 2024-02-07CVE-2024-0628: The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the RSS feed source in…
PriorityP416low3.8CVSS 3.1
AVNACLPRHUINSUCLILAN
EPSS
0.36%
28.2th percentile
The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the RSS feed source in admin settings. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wprssaggregator | wp_rss_aggregator | <= 4.23.5 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/changeset/3029525/wp-rss-aggregatorhttps://www.wordfence.com/threat-intel/vulnerabilities/id/2154383e-eabb-4964-8991-423dd68d5efb?source=cvehttps://plugins.trac.wordpress.org/changeset/3029525/wp-rss-aggregatorhttps://www.wordfence.com/threat-intel/vulnerabilities/id/2154383e-eabb-4964-8991-423dd68d5efb?source=cve
2024-02-07
Published