Cyber Resilience

CVE-2024-13618

HighPublic PoC

Published: 25 March 2025

Published
25 March 2025
Modified
20 June 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS Score 0.0017 38.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13618 is a high-severity an unspecified weakness vulnerability in Osteopathic Downloadable By American Osteopathic Association. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2024-13618 is a vulnerability in the aoa-downloadable WordPress plugin through version 0.1.0. The plugin's download.php endpoint lacks proper authorization and authentication checks, enabling unauthenticated visitors to submit requests that fetch content from arbitrary URLs. This issue has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), classified as high severity with a changed scope.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity by directly accessing the download.php endpoint and specifying any target URL. Successful exploitation allows attackers to proxy requests through the vulnerable WordPress site, potentially leading to server-side request forgery (SSRF). This could enable limited confidentiality impacts, such as reading sensitive data from internal services, or integrity impacts like triggering unintended actions on reachable endpoints, without direct availability disruption.

The WPScan advisory at https://wpscan.com/vulnerability/d6a78233-3f23-4da4-9bc0-1439cde20a30/ provides details on the vulnerability, including recommended mitigations such as updating the plugin if a patched version is available or removing it entirely from affected sites.

EU & UK References

Vulnerability details

The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.

CWE(s)
NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The CVE describes an SSRF vulnerability in a public-facing WordPress plugin (download.php endpoint) that can be exploited remotely without authentication, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-13617Same product: Osteopathic Downloadable By American Osteopathic Association

Affected Assets

osteopathic
downloadable by american osteopathic association
≤ 0.1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations to prevent unauthenticated access to the download.php endpoint that enables SSRF.

AC-14 Permitted Actions Without Identification or Authentication good match
prevent

Defines and restricts specific actions permitted without identification or authentication, prohibiting unauthenticated arbitrary URL requests.

SI-10 Information Input Validation good match
prevent

Validates user-supplied URLs in the download endpoint to prevent SSRF by ensuring only authorized and safe inputs are processed.

References