Cyber Posture

CVE-2024-13923

High

Published: 20 March 2025

Published
20 March 2025
Modified
26 March 2025
KEV Added
—
Patch
—
CVSS Score 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
EPSS Score 0.0008 24.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

Security Summary

CVE-2024-13923 is a Server-Side Request Forgery (SSRF) vulnerability, classified under CWE-918, affecting the Order Export & Order Import for WooCommerce plugin for WordPress in all versions up to and including 2.6.0. The flaw resides in the validate_file() function, which fails to properly restrict requests, enabling unauthorized server-side interactions. It carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N), reflecting high confidentiality impact with changed scope due to potential access to internal resources.

Authenticated attackers with Administrator-level access or higher can exploit this vulnerability by leveraging the plugin's functionality to initiate web requests to arbitrary locations from the web application server. This allows them to query sensitive information from internal services or, in some cases, modify data, bypassing network restrictions and exposing backend systems to reconnaissance or limited manipulation.

Advisories from Wordfence detail the vulnerability and its exploitation vectors, while a patch is available in WordPress plugin trac changeset 3258567, addressing the issue in the class-import-ajax.php file around line 175. Security practitioners should update to a version beyond 2.6.0 and review access controls for admin users on affected WordPress installations.

Details

CWE(s)
CWE-918

Affected Products

webtoffee
order export \& order import for woocommerce
≤ 2.6.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1018 Remote System Discovery Discovery
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
attack.mitre.org →
T1046 Network Service Discovery Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
attack.mitre.org →
Why these techniques?

SSRF in public-facing WordPress plugin directly maps to T1190 for exploitation; enables internal reconnaissance of systems/services via arbitrary server requests.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References