Medium severity · published Jan 22, 2025
CVE-2024-13360
AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Subscriber+) Server-Side Request Forgery
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.96 via the wpaicg_troubleshoot_add_vector(). This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
AI Puffer – Your AI engine for WordPress (formerly AI Power) · senols
through 1.8.96 · source: vendor
AI
Aipower · Aipower
before 1.8.97 · source: NVD
Affected product
AP
AI Puffer – Your AI engine for WordPress (formerly AI Power)
senols
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-13360
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-13360
Patch
https://plugins.trac.wordpress.org/changeset/3224162/
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/5cf6cbba-0e0c-4d2c-90d0-d7e0a5222df2?source=cve
More from AI Puffer – Your AI engine for WordPress (formerly AI Power)
9.8
CVE-2024-10392
AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Upload
8.8
CVE-2024-13361
AI Power: Complete AI Pack <= 1.8.96 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution
7.2
CVE-2025-0429
AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_ai_forms
7.2
CVE-2025-0428
AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_prompts