CVE-2024-13856
CVSS 3.1 Score 6.4 of 10 (medium)
Details
Published Mar 22, 2025
CWE ID 918
Summary
CVE-2024-13856: The Your Friendly Drag and Drop Page Builder plugin for WordPress, versions up to 1.1.10, is susceptible to Server-Side Request Forgery. This vulnerability allows authenticated attackers with Subscriber-level access or higher to make web requests to arbitrary locations from the application. Consequently, attackers can manipulate and obtain sensitive information from internal services.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.