CVE-2024-10705: Multiple Page Generator Plugin SSRF Flaw

CVE-2024-10705 Overview

CVE-2024-10705 is a Server-Side Request Forgery (SSRF) vulnerability in the Multiple Page Generator Plugin (MPG) for WordPress, developed by Themeisle. The flaw affects all versions up to and including 4.0.5 and resides in the mpg_download_file_by_link function. Authenticated attackers with editor-level access or higher can force the WordPress server to issue arbitrary web requests. These requests originate from the web application itself, enabling attackers to query and modify data on internal services normally shielded from external networks. The issue is classified as CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated editors can pivot through the WordPress host to reach internal-only services, cloud metadata endpoints, and non-routable network segments.

Affected Products

Themeisle Multiple Page Generator Plugin (MPG) for WordPress — all versions through 4.0.5
WordPress sites where editor-level or higher accounts exist and MPG is active
Environments where the WordPress host has network reachability to internal services

Discovery Timeline

2025-01-26 - CVE-2024-10705 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-10705

Vulnerability Analysis

The Multiple Page Generator Plugin exposes the mpg_download_file_by_link function to authenticated users. The function accepts a user-supplied URL and performs an outbound HTTP request from the WordPress server. The plugin does not adequately validate or restrict the destination of that request. As a result, an attacker with editor-level privileges can supply URLs pointing to internal endpoints such as http://127.0.0.1, http://169.254.169.254/ (cloud instance metadata), or private RFC 1918 ranges.

Because the request originates from the trusted server, network controls such as firewalls and access lists that filter external traffic do not apply. The attacker can read responses returned by the plugin and, depending on the target service, trigger state-changing requests against unauthenticated internal APIs.

Root Cause

The root cause is missing allow-list validation on the URL parameter passed to mpg_download_file_by_link. The function trusts the destination provided by the caller and does not restrict schemes, resolve hostnames against internal ranges, or block redirects to private networks. This maps directly to [CWE-918].

Attack Vector

Exploitation requires an authenticated session with editor-level access or higher. The attacker invokes the vulnerable plugin functionality and supplies a crafted URL as the download target. The WordPress backend fetches the resource and returns data influenced by the response. Common abuse patterns include enumerating internal HTTP services, retrieving cloud metadata credentials, and probing databases or admin interfaces bound to localhost. Refer to the Wordfence vulnerability report for additional technical context.

Detection Methods for CVE-2024-10705

Indicators of Compromise

Outbound HTTP requests from the WordPress PHP process to internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or to 169.254.169.254.
Web server access logs showing repeated calls to MPG admin-ajax endpoints or the mpg_download_file_by_link handler by editor accounts.
Unexpected editor-account logins from unusual IPs or user agents shortly before SSRF-style traffic patterns appear.

Detection Strategies

Inspect PHP process network telemetry for connections targeting private, link-local, or loopback addresses that were not initiated by legitimate WordPress workflows.
Correlate WordPress authentication logs with plugin request logs to identify editor accounts invoking mpg_download_file_by_link.
Deploy web application firewall rules that inspect URL parameters submitted to MPG endpoints and block private or metadata IP ranges.

Monitoring Recommendations

Enable verbose logging on the WordPress instance and forward logs to a centralized analytics platform for retention and correlation.
Monitor cloud provider audit logs for anomalous instance-metadata calls originating from WordPress hosts.
Alert on new or dormant editor-level accounts that suddenly begin interacting with plugin download functionality.

How to Mitigate CVE-2024-10705

Immediate Actions Required

Upgrade the Multiple Page Generator Plugin to a version later than 4.0.5 as published in the WordPress plugin changeset 3205550.
Audit all WordPress accounts with editor-level access or higher and remove or downgrade unnecessary privileges.
Rotate any credentials, API keys, or cloud instance-metadata tokens that could have been reached from the WordPress host.

Patch Information

Themeisle addressed the SSRF in the mpg_download_file_by_link function in a subsequent release tracked in WordPress plugin changeset 3205550. Site operators should apply the update through the WordPress plugin manager or by pulling the fixed release directly from the plugin repository. Confirm the installed version reports higher than 4.0.5 after upgrade.

Workarounds

Deactivate the Multiple Page Generator Plugin until the patched version can be installed.
Restrict outbound network access from the WordPress host to only required destinations using host-based or perimeter firewall rules.
Enforce IMDSv2 on cloud instances to require session tokens for metadata access and reduce SSRF impact.
Block private, loopback, and link-local IP ranges at the web application firewall for parameters that accept user-controlled URLs.

bash

# Example egress restriction using iptables to block metadata endpoint access from the WordPress host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner www-data -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner www-data -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner www-data -j REJECT