Low severity2.7NVD Advisory· Published Aug 2, 2021· Updated Jun 17, 2026
CVE-2021-24371
CVE-2021-24371
Description
The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:carrcommunications:rsvpmaker:*:*:*:*:*:wordpress:*:*Range: <8.7.3
- WordPress/RSVPMaker WordPress plugindescription
Patches
Vulnerability mechanics
References
2- codevigilant.com/disclosure/2021/wp-plugin-rsvpmaker/nvdExploitPatchThird Party Advisory
- wpscan.com/vulnerability/63be225c-ebee-4cac-b43e-cf033ee7425dnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.