CVE-2024-4789: Cost Calculator Builder Pro <= 3.1.72 - Authenticated (Subscriber+) Server-Side Request Forgery
Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the senddemowebhook() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4789?
CVE-2024-4789 has been classified as a moderate severity vulnerability due to its potential for authenticated exploitation.
How do I fix CVE-2024-4789?
To mitigate CVE-2024-4789, update the Cost Calculator Builder Pro plugin to version 3.1.73 or later.
Who is affected by CVE-2024-4789?
CVE-2024-4789 affects all versions of the Cost Calculator Builder Pro plugin up to 3.1.72.
What type of attack does CVE-2024-4789 allow?
CVE-2024-4789 allows authenticated attackers to perform Server-Side Request Forgery attacks.
What function is responsible for the vulnerability in CVE-2024-4789?
The send_demo_webhook() function is responsible for the Server-Side Request Forgery vulnerability in CVE-2024-4789.