CVE-2024-30532 MEDIUM

CVE-2024-30532: WordPress Builderall Builder for WordPress plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability

Vendor Builderall Team
Product Builderall Builder for WordPress
Weakness CWE-918 · SSRF
Published April 2, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.9/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in Builderall Team Builderall Builder for WordPress.This issue affects Builderall Builder for WordPress: from n/a through 2.0.1.

Explanation of Vulnerability in Simple Terms

02Summary

The Builderall Builder plugin for WordPress contains a server-side request forgery (SSRF) vulnerability that allows authenticated users with low privileges to make the site send HTTP requests to internal or external systems on their behalf. The vulnerability has limited scope impact and requires network access but no user interaction. Affected versions are 2.0.1 and earlier.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal systems or external servers the attacker specifies.

Potential impact on your site

04Site Impact

Attackers with basic WordPress accounts can probe your internal network, access private services, or trigger actions on external systems.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).

Key dates

06Disclosure timeline

April 2, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-5737 Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route CVE-2026-65466 WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-13233 OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053 CVE-2025-60175 WordPress PopAd Plugin <= 1.0.4 - Server Side Request Forgery (SSRF) Vulnerability CVE-2026-57681 WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability