Wpgetapi Vulnerabilities

The WPGet API – Connect to any external REST API plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the...

CVSS:

5.5

Affected:

up to 2.2.10

Fixed in:

2.25.1

Disclosed:

Mar 6, 2025

CVE-2024-13857 on NVD →

The WPGetAPI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_endpoints() function in versions 2.1.0 - 2.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options which can be levera...

CVSS:

6.3

Affected:

2.1.0 – 2.2.2

Fixed in:

2.2.2

Disclosed:

Oct 2, 2023