CVE-2024-31229 MEDIUM

CVE-2024-31229: WordPress Really Simple SSL plugin <= 7.2.3 - Server Side Request Forgery (SSRF) vulnerability

Vendor Really Simple Plugins
Product Really Simple SSL
Weakness CWE-918 · SSRF
Published April 18, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in Really Simple Plugins Really Simple SSL.This issue affects Really Simple SSL: from n/a through 7.2.3.

Explanation of Vulnerability in Simple Terms

02Summary

Really Simple SSL versions up to 7.2.3 contain a server-side request forgery vulnerability that allows high-privilege users to make the site send HTTP requests to internal or external systems on the attacker's behalf. The vulnerability requires administrator access and does not directly impact confidentiality or availability, but can be used to probe internal infrastructure or interact with external services.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal or external systems the attacker specifies.

Potential impact on your site

04Site Impact

An admin account compromise could allow an attacker to probe your internal network or interact with external APIs using your site's IP address.

Conditions required to exploit

05Prerequisites

Administrator access to the WordPress site; no user interaction required.

Key dates

06Disclosure timeline

April 18, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-4302 WowOptin: Next-Gen Popup Maker <= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API CVE-2026-57407 WordPress PDF Generator for WordPress plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-39630 WordPress Getty Images plugin <= 4.1.0 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-57348 WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-0688 Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery