Blind Server-Side Request Forgery Vulnerability in Starter Templates by FancyWP for WordPress

CVE-2024-13924

What is CVE-2024-13924?

The Starter Templates plugin by FancyWP is susceptible to a Blind Server-Side Request Forgery vulnerability in all versions up to 2.0.0. This flaw allows unauthenticated attackers to exploit the 'http_request_host_is_external' filter, enabling them to send web requests to arbitrary locations through the affected web application. The vulnerability can lead to unauthorized query and modification of sensitive information from internal services, posing a significant risk to website integrity and security.

References