CVE-2024-13360 Details
Description
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.96 via the wpaicg_troubleshoot_add_vector(). This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the AI Power: Complete AI Pack plugin for WordPress, affecting all versions through 1.8.96. The vulnerability arises in the 'wpaicg_troubleshoot_add_vector' function, allowing authenticated attackers with subscriber-level access or higher to send web requests to arbitrary locations from the web application. This could be exploited to query and modify information from internal services.
Users are advised to update the AI Power: Complete AI Pack plugin to version 1.8.97 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 22, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| aipower aipower | < 1.8.97 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 24, 2025 | Initial Analysis | [email protected] |
| Jan 22, 2025 | New CVE Received | [email protected] |