Migration Backup Restore < 3.5.0 – Admin+ SSRF | CVE 2024-4469 | Plugin Vulnerabilities

Description

The plugin does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.

Proof of Concept

1. Click on "Upload Backup" and add http://127.0.0.1:XXX/123.wpstg -> "Upload". 

If the port is open it will return an error "Not Found" to user. If the port isn't open it will return nothing.

Affects Plugins

Fixed in 3.5.0

References

CVE

URL

https://research.cleantalk.org/cve-2024-4469/

YouTube Video

Classification

Type

SSRF

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://research.cleantalk.org

Verified

Yes

WPVDB ID

d6b1270b-52c0-471d-a5fb-507e21b46310

Timeline

Publicly Published

2024-05-10 (about 1 year ago)

Added

2024-05-10 (about 1 year ago)

Last Updated

2024-05-10 (about 1 year ago)

Other

Published

Title

Published

2025-03-27

Title

Metform < 3.9.3 - Admin+ SSRF

Published

2025-11-18

Title

Responsive Lightbox & Gallery < 2.5.4 - Authenticated (Author+) Server-Side Request Forgery

Published

2013-06-21

Title

WordPress 3.5-3.5.1 HTTP API Unspecified Server Side Request Forgery (SSRF)

Published

2025-08-26

Title

Chartbeat <= 2.0.7 - Authenticated (Subscriber+) Server-Side Request Forgery

Published

2024-04-22

Title

FV Flowplayer Video Player < 7.5.45.7212 - Authenticated (Subscriber+) Server-side Request Forgery