CVE-2024-10814

Name of the Vulnerable Software and Affected Versions Code Embed plugin for WordPress versions up to 2.5

Description The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery via the ce get file() function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Recommendations For Code Embed plugin for WordPress versions up to 2.5, update to the latest version to mitigate the risk of Server-Side Request Forgery. As a temporary workaround, consider restricting access to the ce get file() function until a patch is available.