CVE-2024-38791 MEDIUM

CVE-2024-38791: WordPress AI ENGINE plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability

Vendor Jordy Meow
Product AI Engine: ChatGPT Chatbot
Weakness CWE-918 · SSRF
Published August 1, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.9/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.4.7.

Explanation of Vulnerability in Simple Terms

02Summary

The AI Engine: ChatGPT Chatbot plugin contains a server-side request forgery vulnerability that allows authenticated users to make the site send HTTP requests to internal or external systems on the attacker's behalf. The vulnerability requires low-level authentication and high attack complexity. Impact is limited to confidentiality and integrity of data accessible through those requests.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal systems or external URLs under the site's identity.

Potential impact on your site

04Site Impact

Authenticated attackers can probe internal networks, access internal services, or trigger actions on external systems via your site.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site; no user interaction required.

Key dates

06Disclosure timeline

August 1, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-6514 InfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read via 'url' Parameter CVE-2026-3530 OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025 CVE-2026-1273 PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints CVE-2026-57348 WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-24964 WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability