Server-Side Request Forgery in Your Friendly Drag and Drop Page Builder Plugin
CVE-2024-13856
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 22 March 2025
What is CVE-2024-13856?
The Make Builder plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF) due to a flaw in the make_builder_ajax_subscribe() function. This vulnerability allows authenticated users with Subscriber-level access and above to send unauthorized web requests to remote locations. As a result, attackers can potentially interact with internal services, compromising the security and confidentiality of sensitive information. It is crucial for users of the affected versions to take immediate action to mitigate this risk.
Affected Version(s)
Your Friendly Drag and Drop Page Builder — Make Builder * <= 1.1.10