Kadence Blocks Page Builder Features Plugin Vulnerable to Server-Side Request Forgery
CVE-2023-6964

8.5HIGH

Key Information:

Vendor
Wordpress
Status
Gutenberg Blocks By Kadence Blocks – Page Builder Features
Vendor
CVE Published:
9 April 2024

Summary

The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress has a vulnerability related to Server-Side Request Forgery (SSRF) that affects all versions prior to and including 3.1.26. This vulnerability can be exploited by authenticated users with contributor-level access and above through the 'kadence_import_get_new_connection_data' AJAX action. Successful exploitation allows attackers to send web requests to arbitrary locations, potentially enabling them to query and alter information within internal services, thereby posing a serious security risk to affected WordPress installations.

Affected Version(s)

Gutenberg Blocks by Kadence Blocks – Page Builder Features * <= 3.1.26

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucio Sá
.