CVE-2024-13905

KRITISCH 9.1CVE-2024-13905 · Published 27/02/2025 · updated 17/06/2026

Kurz gesagt

CVE-2024-13905 ist eine Schwachstelle (KRITISCH (CVSS 9.1)) in onestore sites (sainwp).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.37%, höher als bei 31.2% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
onestore sites sainwp	`≤ 0.1.1`	No fix yet

Description

The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the class-export.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

References

plugins.trac.wordpress.org/browser/onestore-sites/trunk/classess/class-export.php · Patch
wordfence.com/threat-intel/vulnerabilities/id/f2c70d5f-beb3-480e-8ea8-c3ab01ce5a20 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free