CVE-2024-33627 MEDIUM

CVE-2024-33627: WordPress AGCA – Custom Dashboard & Login Page plugin <= 7.2.2 - Server Side Request Forgery (SSRF) vulnerability

Vendor Cusmin
Product Absolutely Glamorous Custom Admin
Weakness CWE-918 · SSRF
Published April 29, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.4/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in Cusmin Absolutely Glamorous Custom Admin.This issue affects Absolutely Glamorous Custom Admin: from n/a through 7.2.2.

Explanation of Vulnerability in Simple Terms

02Summary

Absolutely Glamorous Custom Admin versions up to 7.2.2 contain a server-side request forgery vulnerability. An authenticated administrator can craft requests that cause the application to make HTTP requests to internal or external systems on their behalf. The vulnerability requires high privileges and complex attack conditions. Confidentiality and integrity of backend systems may be compromised.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal systems or external servers under the site's identity.

Potential impact on your site

04Site Impact

An admin account compromise could expose internal services or allow data exfiltration via the site's outbound requests.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the application.

Key dates

06Disclosure timeline

April 29, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension CVE-2026-1648 Performance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter CVE-2026-2948 Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl' CVE-2026-39647 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.11 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-61970 WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability