CVE-2024-29090 MEDIUM

CVE-2024-29090: WordPress AI Engine plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability

Vendor Jordy Meow
Product AI Engine: ChatGPT Chatbot
Weakness CWE-918 · SSRF
Published March 28, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4.

Explanation of Vulnerability in Simple Terms

02Summary

AI Engine: ChatGPT Chatbot versions up to 2.1.4 contain a server-side request forgery vulnerability that allows high-privilege users to make the site send HTTP requests to internal or external systems on their behalf. An attacker with admin or equivalent access can probe internal networks, access metadata services, or interact with backend systems. The scope is changed, meaning the impact extends beyond the plugin itself.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal systems or external URLs to read sensitive data or interact with backend services.

Potential impact on your site

04Site Impact

A compromised admin account can be used to probe your internal network, access cloud metadata, or attack other systems your site can reach.

Conditions required to exploit

05Prerequisites

Attacker must have high-privilege access (admin or equivalent role) on the site.

Key dates

06Disclosure timeline

March 28, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-24639 WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-0686 Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery CVE-2026-10586 Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery CVE-2026-65496 WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-24964 WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability