5.4
Medium
CVE-2024-10705 The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all…
Description
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.5 via the 'mpg_download_file_by_link' function. This makes it possible for authenticated attackers, with editor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Multiple Page Generator Plugin – MPG 4.0 | earliest → 4.0.5 | No fix stated |
Other CVEs of Multiple Page Generator Plugin – MPG
The 12 CVEs of Multiple Page Generator Plugin – MPG →
CVE-2024-10672
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to…
2.7
Low
CVE-2024-7424
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access…
5.4
Medium
CVE-2024-47325
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle MPG…
8.5
High
CVE-2024-31301
Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Multiple Page Generator Plugin – MPG.This issue affects…
5.4
Medium