CVE-2024-38730 WordPress Magical Addons For Elementor plugin <= 1.1.41 - Server Side Request Forgery (SSRF) vulnerability

What is CVE-2024-38730?

CVE-2024-38730 is a medium-severity server-side request forgery vulnerability in Noor alam Magical Addons For Elementor, published on 22 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Server-Side Request Forgery (SSRF) vulnerability in Noor alam Magical Addons For Elementor.This issue affects Magical Addons For Elementor: from n/a through 1.1.41.

Weakness: CWE-918

Which versions are affected by CVE-2024-38730?

It affects 1 product.

Products include Wpthemespace Magical Addons for Elementor.

How do I fix CVE-2024-38730?

No fix has been published for CVE-2024-38730 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-38730 being exploited?

There is no known exploitation of CVE-2024-38730 in the wild and no public exploit code.

Other vulnerabilities in Noor alam Magical Addons For Elementor

• CVE-2024-54212 WordPress Magical Addons For Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-38681 WordPress Magical Addons For Elementor plugin <= 1.1.41 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-34547 WordPress Magical Addons For Elementor plugin <= 1.1.34 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-5161 Magical Addons For Elementor <= 1.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium 6.4
• CVE-2024-2923 Cross-site scripting in Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4x9j-cjq3-hxhf.