CVE-2024-13856: Make Builder <= 1.1.10 - Authenticated (Subscriber+) Server-Side Request Forgery via make_builder_ajax_subscribe Function
First published: Sat Mar 22 2025(Updated: )
The Your Friendly Drag and Drop Page Builder — Make Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.10 via the make_builder_ajax_subscribe() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Make Make Builder | <=1.1.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7ffcb74b-230b-4629-b22d-5db96ac5fa06?source=cve
- https://wordpress.org/plugins/make-builder/#developers
- https://plugins.trac.wordpress.org/browser/make-builder/trunk/plugins-screen.php#L83
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3259333%40make-builder%2Ftrunk&old=2235851%40make-builder%2Ftrunk&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2024-13856?
CVE-2024-13856 is classified as a critical severity vulnerability due to its potential for server-side request forgery.
How do I fix CVE-2024-13856?
To fix CVE-2024-13856, update the Make Builder plugin to version 1.1.11 or later.
Who is affected by CVE-2024-13856?
CVE-2024-13856 affects all versions of the Make Builder plugin for WordPress up to and including version 1.1.10.
What type of attack can CVE-2024-13856 enable?
CVE-2024-13856 enables authenticated attackers to carry out server-side request forgery attacks.
What function is associated with CVE-2024-13856?
CVE-2024-13856 is associated with the make_builder_ajax_subscribe() function in the Make Builder plugin.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/source
- agent/severity
- agent/tags
- agent/event
- vendor/make
- canonical/make make builder