OneStore Sites, CVE-2024-13905

CVE, Research URL: CVE-2024-13905
Home page URL: Security reports for OneStore Sites
Application: OneStore Sites
Published on: Feb 27, 2025
Research Description: The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the class-export.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected versions: max 0.1.1.
Status: vulnerable