WordPress Plugin Vulnerabilities

ShortPixel Adaptive Images < 3.8.4 - Authenticated (Admin+) Server-Side Request Forgery

Description

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.8.3 via the is_our_cdn() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
shortpixel-adaptive-images
Fixed in 3.8.4

References

CVE
CVE-2024-35172
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e72b7e6b-c8ad-44be-b23d-69e8a27670ea

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.5 (medium)

Miscellaneous

Original Researcher
Dhabaleshwar Das
Verified
No
WPVDB ID
9b1fad9d-2370-4fa8-8d66-73b287ca2044

Timeline

Publicly Published
2024-05-10 (about 2 years ago)
Added
2024-05-15 (about 2 years ago)
Last Updated
2024-05-15 (about 2 years ago)

Other

Published
Title
Published
2026-03-10
Title
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe < 28.1.2.2 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2014-08-01
Title
WordPress 1.5.1-3.5 - XML-RPC Pingback API Internal/External Port Scanning
Published
2024-04-22
Title
Culqi < 3.0.15 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2025-11-26
Title
AI ChatBot with ChatGPT and Content Generator by AYS < 2.7.1 - Unauthenticated Server-Side Request Forgery via 'pinecone_url' Parameter
Published
2025-07-10
Title
Broken Link Notifier < 1.3.1 - Unauthenticated Server-Side Request Forgery