CVE-2024-35172 MEDIUM

CVE-2024-35172: WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Server Side Request Forgery (SSRF) vulnerability

Vendor Shortpixel

Product ShortPixel Adaptive Images

Weakness CWE-918 · SSRF

Published May 13, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

4.4/10

Attack vector Network

Attack complexity High

Privileges required High

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.3.

Explanation of Vulnerability in Simple Terms

02Summary

ShortPixel Adaptive Images versions 3.8.3 and earlier contain a server-side request forgery vulnerability. An authenticated administrator can craft requests that cause the site to make HTTP requests to internal or external systems on the attacker's behalf. The impact is limited to information disclosure and minor modifications; availability is not affected.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal or external systems and read responses.

Potential impact on your site

04Site Impact

An admin account compromise could expose internal network information or modify external resources the site can reach.

Conditions required to exploit

05Prerequisites

Attacker must have administrator privileges; no user interaction required.

Key dates

06Disclosure timeline

May 13, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-35172 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/918.html AskarLabs — CWE-918 write-up Server-Side Request Forgery

Related vulnerabilities