Server-Side Request Forgery in Noor Alam Magical Addons for Elementor
CVE-2024-51665

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
Magical Addons For Elementor
Vendor
CVE Published:
4 November 2024

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 35%

What is CVE-2024-51665?

A Server-Side Request Forgery (SSRF) vulnerability in Noor Alam Magical Addons for Elementor allows an attacker to send unauthorized requests from the server. This can potentially lead to exposure of sensitive information, as the vulnerable function can be exploited to make requests to internal services or external resources without proper authorization. Users of the Magical Addons For Elementor plugin must ensure they are using updated versions to mitigate this risk.

Affected Version(s)

Magical Addons For Elementor 0 <= 1.2.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-51665
Created by RandomRobbieBF

References

https://patchstack.com/database/Wordpress/Plugin/magical-...
vdb-entry

EPSS Score

35% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

.