CVE-2024-13618

Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated SSRF

High · published March 25, 2025

CVSS v3.1
7.2
EPSS
0%
Percentile
24.1
In the wild
Unconfirmed
What it is

The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00323 · 24.1th percentile
Published
2025-03-25T06:00Z
EPSS history
Timeline
  • 25 MAR 06:00Z
    Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated SSRF
    cvelistv5