CVE-2021-24371

LOW

RSVPMaker < 8.7.3 - Authenticated Server-Side Request Forgery via Import Feature

Title source: llm
STIX 2.1

Description

The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack.

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/63be225c-ebee-4cac-b43e-cf033ee7425d
Exploit, Patch, Third Party Advisory x_refsource_misc
https://codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/

Scores

CVSS v3 2.7
EPSS 0.0101
EPSS Percentile 58.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-918
Status published
Products (1)
carrcommunications/rsvpmaker < 8.7.3
Published Aug 02, 2021
Tracked Since Feb 18, 2026