CVE-2024-54385

Deeper analysis

The Radio Player plugin for WordPress, developed by princeahmed and identified as radio-player, contains a Server-Side Request Forgery (SSRF) vulnerability tracked as CVE-2024-54385. The flaw affects all versions from the initial release through 2.0.83 and is classified under CWE-918. It carries a CVSS 3.1 score of 7.2 with a network attack vector, low complexity, no required privileges or user interaction, and changed scope that permits limited impacts to confidentiality and integrity.

An unauthenticated remote attacker can supply crafted requests that cause the affected WordPress instance to issue arbitrary server-side HTTP requests. Successful exploitation allows the attacker to interact with internal resources, potentially reach metadata services or other backend systems, and obtain limited information or induce side effects on the hosting server.

The public Patchstack advisory at the referenced URL documents the issue for the Radio Player plugin and identifies the affected version range, indicating that administrators should update beyond 2.0.83 once a corrected release is available. The EPSS score has reached a peak of 0.8631 with a current value of 0.8095, reflecting notable post-disclosure interest in exploitation.