CVE-2024-13618

Description

The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.

Reserved 2025-01-22 | Published 2025-03-25 | Updated 2025-03-25 | Assigner WPScan

Problem types

CWE-918 Server-Side Request Forgery (SSRF)

Product status

Default status
affected

Any version
affected

Credits

Aly Khaled finder

WPScan coordinator

References

wpscan.com/...rability/d6a78233-3f23-4da4-9bc0-1439cde20a30/ exploit vdb-entry technical-description

cve.org (CVE-2024-13618)

nvd.nist.gov (CVE-2024-13618)

Download JSON