CVE-2024-1855: WPCafe <= 2.2.23 - Unauthenticated Blind Server-Side Request Forgery
The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.23 via the wpccheckforsubmission function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1855?
CVE-2024-1855 has a critical severity due to its potential for exploit through Server-Side Request Forgery.
How do I fix CVE-2024-1855?
To fix CVE-2024-1855, upgrade to the latest version of the WPCafe plugin, specifically version 2.2.24 or later.
Which versions are affected by CVE-2024-1855?
CVE-2024-1855 affects all versions of the WPCafe plugin up to and including 2.2.23.
What does CVE-2024-1855 exploit?
CVE-2024-1855 exploits vulnerabilities in the wpc_check_for_submission function, allowing for Server-Side Request Forgery attacks.
Is CVE-2024-1855 specific to WordPress?
Yes, CVE-2024-1855 specifically affects the WPCafe plugin used within WordPress.