Login Request a demo
Medium severity · published May 9, 2024
CVE-2024-1467
Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgery
4.3
CVSS
0.6%
EPSS
No
On KEV
Description
The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.6 via the ai_api_request(). This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Starter Templates – AI-Powered Templates for Elementor & Gutenberg · brainstormforce
through 4.1.6 · source: vendor
Affected product
ST
Starter Templates – AI-Powered Templates for Elementor & Gutenberg
brainstormforce
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1467
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1467
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3074863/astra-sites/tags/4.1.7/inc/classes/class-astra-sites-importer.php
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3074863/astra-sites/tags/4.1.7/inc/classes/class-astra-sites.php
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/cf5075f9-9658-4a09-bd38-34a72f6560f4?source=cve
More from Starter Templates – AI-Powered Templates for Elementor & Gutenberg
8.8
CVE-2025-13065
Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
6.4
CVE-2024-4630
Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting