Blind Server-Side Request Forgery in Platform.ly for WooCommerce Plugin
CVE-2024-13904

5.3MEDIUM

Key Information:

Vendor
WordPress
Status
Platform.ly For WooCommerce
Vendor
CVE Published:
7 March 2025

Summary

The Platform.ly for WooCommerce plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to and including 1.1.6. This vulnerability allows unauthenticated attackers to initiate web requests directed at arbitrary locations utilizing the 'hooks' function. Exploiting this flaw can enable attackers to interact with and potentially alter information on internal services, thereby exposing sensitive data and compromising the integrity of the web application.

Affected Version(s)

Platform.ly for WooCommerce * <= 1.1.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/platformly-for...
https://plugins.trac.wordpress.org/changeset/3249460

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.