WordPress Plugin Vulnerabilities

Radio Player < 2.0.85 - Unauthenticated Server-Side Request Forgery

Description

The plugin is vulnerable to Server-Side Request Forgery. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
radio-player
Fixed in 2.0.85

References

CVE
CVE-2024-54385
URL
https://patchstack.com/database/wordpress/plugin/radio-player/vulnerability/wordpress-radio-player-plugin-2-0-82-server-side-request-forgery-ssrf-vulnerability

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Malvin Valerian Gultom
Verified
No
WPVDB ID
3fd4d3cc-19a7-4698-8e77-42282bfd0e7b

Timeline

Publicly Published
2024-12-12 (about 1 year ago)
Added
2024-12-19 (about 1 year ago)
Last Updated
2025-05-21 (about 1 year ago)

Other

Published
Title
Published
2023-12-21
Title
JSM file_get_contents() Shortcode < 2.7.1 - Contributor+ SSRF
Published
2024-05-30
Title
Auto Featured Image (Auto Post Thumbnail) <= 4.0.0 - Authenticated (Author+) Server-Side Request Forgery
Published
2025-04-09
Title
Photography <= 7.5.2 - Unauthenticated Server-Side Request Forgery
Published
2024-06-06
Title
TablePress – Tables in WordPress made easy < 2.3.2 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebind
Published
2026-01-05
Title
Xagio SEO < 7.1.0.31 - Authenticated (Subscriber+) Server-Side Request Forgery