PT-2025-1604 · WordPress · Multiple Page Generator Plugin

Arkadiusz Hydzik · Published 2025-01-26 · Updated 2025-01-26 · CVE-2024-10705

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Multiple Page Generator Plugin – MPG plugin for WordPress versions up to, and including, 4.0.5

Description The issue allows authenticated attackers, with editor-level access and above, to make web requests to arbitrary locations originating from the web application via the mpg download file by link function. This can be used to query and modify information from internal services.

Recommendations For versions up to, and including, 4.0.5, consider disabling the mpg download file by link function as a temporary workaround until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation, ensuring only necessary personnel have editor-level access or above.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-10705

Affected Products

Multiple Page Generator Plugin

References · 9

• https://osv.dev/vulnerability/CVE-2024-10705 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3205550/multiple-pages-generator-by-porthas · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-10705 · Security Note
• https://twitter.com/VulmonFeeds/status/1883424558058774869 · Twitter Post
• https://t.me/cvedetector/16407 · Telegram Post
• https://twitter.com/CVEnew/status/1883407111159435461 · Twitter Post
• https://t.me/cvenotify/108633 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7b3446e5-ca01-4468-927a-86e951e662ab?source=cve · Note
• https://twitter.com/WolfgangSesin/status/1883449226870300694 · Twitter Post