{"id":"CVE-2024-4469","aliases":["EUVD-2024-44084","GHSA-hw5v-77jj-prp8"],"status":"published","title":"Migration Backup Restore \u003c 3.5.0 - Admin+ SSRF","description":"The WP STAGING WordPress Backup Plugin  WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00591,"percentile":0.48586,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2024-05-31T06:00:02Z","modified":"2026-06-17T08:01:56Z","products":[{"vendor":"unknown","product":"wp staging wordpress backup plugin"},{"vendor":"wp-staging","product":"wp_staging"}],"references":[{"url":"https://wpscan.com/vulnerability/d6b1270b-52c0-471d-a5fb-507e21b46310/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4469"},{"url":"https://wpscan.com/vulnerability/d6b1270b-52c0-471d-a5fb-507e21b46310"},{"url":"https://github.com/advisories/GHSA-hw5v-77jj-prp8"}],"sources":{"cve":[{"id":"CVE-2024-4469","title":"Migration Backup Restore \u003c 3.5.0 - Admin+ SSRF","description":"The WP STAGING WordPress Backup Plugin  WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.","status":"published","published":"2024-05-31T06:00:02.266Z","modified":"2025-03-18T14:47:18.357Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:34:17.150655Z"}],"euvd":[{"id":"EUVD-2024-44084","description":"The WP STAGING WordPress Backup Plugin  WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.","status":"published","published":"2024-05-31T06:00:02Z","modified":"2025-03-18T14:47:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:53:00.87598Z"}],"ghsa":[{"id":"GHSA-hw5v-77jj-prp8","title":"The WP STAGING WordPress Backup Plugin  WordPress plugin before 3.5.0 does not prevent users with...","description":"The WP STAGING WordPress Backup Plugin  WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.","status":"published","published":"2024-05-31T06:30:28Z","modified":"2025-05-21T21:31:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:02:23.604118Z"}],"nvd":[{"id":"CVE-2024-4469","description":"The WP STAGING WordPress Backup Plugin  WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.","status":"published","published":"2024-05-31T06:15:13.897Z","modified":"2026-06-17T08:01:56.387Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:10:03.465199Z"}]}}