Vulnerability · Published Jul 7, 2021 · Assigned by mitre

CVE-2020-24148

Critical 9.1

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 14.4% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS NVD)9.1Critical

Exploit odds (30 days)14.4%top 3.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling2Nuclei, Public PoC

Official description

Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://wordpress.org/plugins/import-xml-feed/#developers x_refsource_MISC
https://github.com/secwx/research/blob/main/cve/CVE-2020-24148.md x_refsource_MISC