Server-Side Request Forgery in Responsive Plus Plugin for WordPress
CVE-2024-13834

5.4MEDIUM

Key Information:

Vendor
WordPress
Status
Responsive Plus – Starter Templates, Advanced Features And Customizer Settings For Responsive Theme.
Vendor
CVE Published:
15 February 2025

Summary

The Responsive Plus plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF) vulnerabilities in all versions up to and including 3.1.4. This flaw allows authenticated attackers with contributor-level access or higher to utilize the 'remote_request' function, enabling them to initiate web requests to unauthorized internal services. This could lead to the exposure and manipulation of sensitive data within the web environment.

Affected Version(s)

Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. * <= 3.1.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3240422/resp...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.