Severe SSRF Vulnerability in SoftLab Radio Player Affects Multiple Versions
CVE-2024-54385

7.2HIGH

Key Information:

Vendor
WordPress
Status
Radio Player
Vendor
CVE Published:
16 December 2024

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 81%

Summary

The CVE-2024-54385 vulnerability is a critical Server-Side Request Forgery (SSRF) issue identified in versions of SoftLab's Radio Player up to 2.0.82. This vulnerability allows an attacker to send unauthorized requests from the server, potentially leading to the exposure of sensitive data and unauthorized access to internal systems. Users of the Radio Player plugin are urged to upgrade to a patched version immediately to mitigate this significant security risk.

Affected Version(s)

Radio Player <= 2.0.82

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-54385
Created by RandomRobbieBF

References

https://patchstack.com/database/wordpress/plugin/radio-pl...
vdb-entry

EPSS Score

81% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Malvin Valerian Gultom (Patchstack Alliance)
.