CVE-2021-24371— RSVPMaker < 8.7.3 - Authenticated (admin+) SSRF
Quick assessment
Affected
Unknown RSVPMaker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress Plugin RSVPMaker 中存在代码问题漏洞，该漏洞源于产品的 /wp-admin/tools.php?page=rsvpmaker_export_screen 页面的导入功能未能校验URL输入框的数据。攻击者可通过该漏洞扫描内网环
Possible ATT&CK Techniques 2 AI
T1590 · Gather Victim Network Information T1071 · Application Layer Protocol
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-24371
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RSVPMaker < 8.7.3 - Authenticated (admin+) SSRF
Source: CVE Program / CVE List V5
Vulnerability Description
The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Plugin RSVPMaker 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress Plugin RSVPMaker 中存在代码问题漏洞，该漏洞源于产品的 /wp-admin/tools.php?page=rsvpmaker_export_screen 页面的导入功能未能校验URL输入框的数据。攻击者可通过该漏洞扫描内网环
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-24371
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-24371
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-24371 (1)
Other References for CVE-2021-24371 (1)
-
https://codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/ x_refsource_MISC
Same Patch Batch · Unknown · 2021-08-02 · 26 CVEs total
| CVE-2021-24474 | Awesome Weather Widget <= 3.0.2 - Reflected Cross-site Scripting (XSS) | |
| CVE-2021-24444 | TaxoPress < 3.0.7.2 - Authenticated Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24425 | myStickymenu < 2.5.2 - Authenticated Stored XSS | |
| CVE-2021-24428 | RSS for Yandex Turbo <= 1.30 - Authenticated Stored XSS | |
| CVE-2021-24430 | Speed Booster Pack 4.2.0-beta - Authenticated (admin+) RCE | |
| CVE-2021-24443 | Youzify < 1.0.7 - Stored Cross-Site Scripting via Biography | |
| CVE-2021-24448 | Profile Builder < 3.4.8 - Authenticated Stored XSS | |
| CVE-2021-24450 | ProfilePress < 3.1.8 - Authenticated Stored XSS | |
| CVE-2021-24455 | Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24464 | YouTube Embed, Playlist and Popup < 2.3.9 - Contributor+ Stored XSS | |
| CVE-2021-24468 | Leaflet Map < 3.0.0 - Contributor+ Stored XSS | |
| CVE-2021-24470 | Yada Wiki < 3.4.1 - Contributor+ Stored XSS | |
| CVE-2021-24473 | User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR | |
| CVE-2021-24504 | WP LMS <= 1.1.2 - Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24476 | Steam Group Viewer <= 2.1 - Authenticated Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24477 | Migrate Users <= 1.0.1 - CSRF to Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24478 | Bookshelf <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24479 | DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24480 | Event Geek <= 2.5.2 - Stored Cross-site Scripting (XSS) | |
| CVE-2021-24481 | Any Hostname <= 1.0.6 - Authenticated Stored Cross-Site Scripting (XSS) |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: RSVPMaker
-
CVE-2023-25054
WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Remot -
CVE-2023-41652
WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to SQL I -
CVE-2023-25047
WordPress RSVPMarker Plugin <= 9.9.3 is vulnerable to SQL In -
CVE-2023-25045
WordPress RSVPMarker Plugin <= 9.9.3 is vulnerable to SQL In -
CVE-2023-27616
WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Cross
Same vendor: Unknown
-
CVE-2026-77115
Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS -
CVE-2026-77116
Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup -
CVE-2026-77003
Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capabilit -
CVE-2026-14853
WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Pr -
CVE-2026-13598
RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation
Same weakness: CWE-918
-
CVE-2026-78205
BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery vi -
CVE-2026-78061
vas3k TaxHacker Email Sync imap-client.ts buildImapConfig se -
CVE-2026-63311
NLTK before 3.10.0 SSRF via DNS Resolution Failure -
CVE-2026-78003
Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side -
CVE-2026-53509
@aborruso/ckan-mcp-server: SSRF via base_url allows access t
V. Comments for CVE-2021-24371
No comments yet