The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.0.0 via the 'http_request_host_is_external' filter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
References
Configurations
History
12 Mar 2025, 16:23
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:fancywp:starter_templates:*:*:*:*:*:wordpress:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
| First Time |
Fancywp
Fancywp starter Templates |
|
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/9355b100-08a9-4640-a91b-e56ba1ab9b07?source=cve - Third Party Advisory | |
| References | () https://plugins.trac.wordpress.org/browser/starter-templates/trunk/classess/class-export.php#L3 - Product |
08 Mar 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-08 13:15
Updated : 2025-03-12 16:23
NVD link : CVE-2024-13924
Mitre link : CVE-2024-13924
JSON object : View
Products Affected
fancywp
- starter_templates
CWE
CWE-918
Server-Side Request Forgery (SSRF)