CVE Feed

Dashboard / CVE / CVE-2024-6584

CVE-2024-6584

The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.

Published:May 15, 2025

Last Modified:Jun 11, 2025

EPS:May 15, 2025

EPSS Score:0.00146

CVSS Score:9.1

Affected Products

Vendor

Product

Action

Vendor

Automattic

Product

Jetpack Boost

Automattic

Jetpack Boost

Exploits

https://wpscan.com/vulnerability/eaa57c8c-1cac-4903-9763-79f7f84469fa/

Common Weakness Enumeration

CWE-918 Server-Side Request Forgery (SSRF)

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-664 Server Side Request Forgery

Related CVEs

CVE-2022-50958 (CVSS 5.1) — WordPress Plugin Jetpack 9.1 contains a reflected cross-site scripting vulnerability that allows unauthenticat…

CVE-2023-54332 (CVSS 5.1) — Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to…

CVE-2024-10076 (CVSS 5.9) — The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Sit…

References

https://wpscan.com/vulnerability/eaa57c8c-1cac-4903-9763-79f7f84469fa/

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High