Server-Side Request Forgery Vulnerability in WP All Import Pro Plugin for WordPress

CVE-2024-9624

Summary

CVE-2024-9624 identifies a significant Server-Side Request Forgery (SSRF) vulnerability in all versions of the WP All Import Pro plugin for WordPress up to and including 4.9.3. This vulnerability arises from inadequate SSRF protection in the pmxi_curl_download function, which allows attackers with Administrator-level access to send web requests to arbitrary locations. Exploiting this flaw, authenticated attackers could potentially manipulate internal services and extract confidential data from cloud environments, including instance metadata. It underscores the importance of maintaining robust security measures in WordPress plugins to mitigate the risks posed by SSRF vulnerabilities.

References