CVE-2024-11638

Name of the Vulnerable Software and Affected Versions Gtbabel WordPress plugin versions prior to 6.6.9

Description The issue allows unauthenticated attackers to retrieve a logged-in user's cookies, such as an admin's, by making them open a crafted URL. This is possible because the plugin does not verify that the URL for code analysis belongs to the blog, and the request to analyze the URL includes the user's cookies.

Recommendations For versions prior to 6.6.9, update to version 6.6.9 or later to resolve the issue.