CVE-2024-11638 Gtbabel < 6.6.9 - Unauthenticated Admin Account Takeover
Unauthenticated attackers can steal admin cookies via SSRF in Gtbabel plugin, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-11638?
CVE-2024-11638 is a high-severity server-side request forgery vulnerability in Unknown Gtbabel, published on 10 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user (such as admin) cookies by making them open a crafted URL as the request made to analysed the URL contains such cookies.
Which versions are affected by CVE-2024-11638?
It affects 1 product.
Products include Gtbabel Gtbabel.
How do I fix CVE-2024-11638?
No fix has been published for CVE-2024-11638 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-11638 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-11638 exists.
Sources
Also known as GHSA-wrxx-v2cm-rh9h.