PT-2024-39725 · WordPress · Wp All Import Pro

Ivan Kuzymchak · Published 2024-12-17 · Updated 2024-12-17 · CVE-2024-9624

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP All Import Pro plugin for WordPress versions up to, and including, 4.9.3

Description The issue is related to Server-Side Request Forgery due to missing SSRF protection on the pmxi curl download function. This allows authenticated attackers with Administrator-level access and above to make web requests to arbitrary locations from the web application, potentially querying and modifying information from internal services. On cloud platforms, it may also allow attackers to read Instance metadata.

Recommendations For versions up to, and including, 4.9.3, consider disabling the pmxi curl download function until a patch is available to prevent exploitation. Restrict access to the plugin's functionality to minimize the risk of unauthorized web requests. Update to a version higher than 4.9.3 when available.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-9624

Affected Products

Wp All Import Pro

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-9624 · Security Note
• https://t.me/latest_high_impact_cve/1660 · Telegram Post
• https://twitter.com/CVEnew/status/1868896491957571659 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/eabde2e7-5cd4-4c3e-959a-69e04f6350d3?source=cve · Note
• https://t.me/cvedetector/13069 · Telegram Post
• https://wpallimport.com · Note
• https://t.me/cvenotify/104493 · Telegram Post