Medium severity · published Jul 23, 2024
CVE-2024-4260
CoBlocks < 3.1.12 - Contributor+ SSRF
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PB
Page Builder Gutenberg Blocks ·
before 3.1.12 · source: vendor, CISA
CO
Coblocks · Godaddy
before 3.1.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4260
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4260
Exploit
https://wpscan.com/vulnerability/69f33e20-8ff4-491c-8f37-a4eadd4ea8cf/
More from Page Builder Gutenberg Blocks
5.4
CVE-2024-2369
Page Builder Gutenberg Blocks < 3.1.7 - Contributor+ Stored XSS
4.8
CVE-2024-7132
CoBlocks < 3.1.13 - Editor+ Stored XSS