CVE-2024-4789

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demo_webhook() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: May 17, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-478917.8Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.CVE-2024-478927.8Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.CVE-2024-478936.5Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to read and/or write data outside th CVE-2024-478947.1Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virt CVE-2024-478957.1Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to read data outside the Guest's virt CVE-2024-478963.3Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's vi CVE-2024-478978.8Software installed and run as a non-privileged user may conduct improper GPU system calls resulting in platform instability and reboots.CVE-2024-478987.8Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.CVE-2024-478997.8Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.CVE-2024-47907.5A vulnerability classified as problematic has been found in DedeCMS 5.7.114. This affects an unknown part of the file /sys_verifies.php?acti CVE-2024-479007.8Software installed and run as a non-privileged user may conduct improper GPU system calls to access OOB kernel memory.CVE-2024-479019.8A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All ve