CVE-2024-13618
Published: 25 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2024-13618 is a vulnerability in the aoa-downloadable WordPress plugin through version 0.1.0. The plugin's download.php endpoint lacks proper authorization and authentication checks, enabling unauthenticated visitors to submit requests that fetch content from arbitrary URLs. This issue has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), classified as high severity with a changed scope.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity by directly accessing the download.php endpoint and specifying any target URL. Successful exploitation allows attackers to proxy requests through the vulnerable WordPress site, potentially leading to server-side request forgery (SSRF). This could enable limited confidentiality impacts, such as reading sensitive data from internal services, or integrity impacts like triggering unintended actions on reachable endpoints, without direct availability disruption.
The WPScan advisory at https://wpscan.com/vulnerability/d6a78233-3f23-4da4-9bc0-1439cde20a30/ provides details on the vulnerability, including recommended mitigations such as updating the plugin if a patched version is available or removing it entirely from affected sites.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes an SSRF vulnerability in a public-facing WordPress plugin (download.php endpoint) that can be exploited remotely without authentication, directly mapping to exploitation of public-facing applications.