CVE-2024-1855 Overview
CVE-2024-1855 is a Server-Side Request Forgery (SSRF) vulnerability in the WPCafe WordPress plugin developed by Themewinter. The plugin provides restaurant menu, online ordering, pickup/delivery, and table reservation functionality for WooCommerce. All versions up to and including 2.2.23 are affected. The flaw resides in the wpc_check_for_submission function, which fails to validate destination URLs before issuing outbound HTTP requests. Unauthenticated attackers can abuse the function to make the WordPress server issue arbitrary web requests to attacker-chosen locations, including internal network resources normally shielded from the public internet.
Critical Impact
Unauthenticated remote attackers can force the WordPress server to make outbound requests to arbitrary URLs, enabling internal network reconnaissance and potential access to metadata services on cloud-hosted installations.
Affected Products
- Themewinter WPCafe plugin for WordPress, all versions up to and including 2.2.23
- WordPress sites running the WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin
- WooCommerce-enabled WordPress deployments that installed WPCafe for restaurant ordering workflows
Discovery Timeline
- 2024-05-23 - CVE-2024-1855 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1855
Vulnerability Analysis
The vulnerability is categorized under CWE-918: Server-Side Request Forgery. The wpc_check_for_submission AJAX handler in the WPCafe plugin accepts a URL-like parameter from an unauthenticated HTTP request and passes it to a server-side HTTP client without validating the destination host or scheme.
Because the AJAX endpoint does not enforce authentication or capability checks, any anonymous visitor can invoke the handler. The WordPress server then issues the outbound request on the attacker's behalf. The response, or side effects of the request, can be leveraged to probe internal services, scan the internal network, or interact with cloud instance metadata endpoints such as 169.254.169.254.
Root Cause
The root cause is missing input validation in the wpc_check_for_submission function located in core/action/wpc-ajax-action.php. The function accepts a user-controlled URL parameter and forwards it directly to a server-side request routine. No allowlist restricts destination hosts. No scheme filter blocks internal or loopback addresses. The vendor's fix in changeset 3084054 modifies this handler to validate the target before performing the outbound call. See the WordPress Changeset Update for the patch details.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP POST request to the WordPress admin-ajax.php endpoint targeting the vulnerable WPCafe AJAX action. The URL parameter contains the attacker-chosen destination. The WordPress server executes the outbound request and, depending on plugin behavior, may return response data or leak timing information back to the attacker. Full technical detail is available in the Wordfence Vulnerability Report and the WordPress Plugin Source Code.
Detection Methods for CVE-2024-1855
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php referencing the wpc_check_for_submission action from unauthenticated sources
- Outbound HTTP requests from the WordPress server to internal RFC1918 addresses, 127.0.0.1, or cloud metadata endpoints such as 169.254.169.254
- Unusual spikes in outbound connections originating from the PHP worker process on hosts running WPCafe versions at or below 2.2.23
Detection Strategies
- Inspect web server access logs for repeated calls to admin-ajax.php carrying the wpc_check_for_submission action parameter
- Correlate inbound anonymous WPCafe AJAX requests with subsequent outbound connections from the same web server process
- Deploy web application firewall rules that alert on URL-parameter values pointing to private IP ranges, link-local addresses, or non-HTTP schemes
Monitoring Recommendations
- Enable egress logging on WordPress hosts and alert on destinations outside expected third-party service allowlists
- Track WPCafe plugin version inventory across managed WordPress installations to identify vulnerable instances
- Monitor cloud instance metadata service (IMDS) access logs for requests originating from web application processes
How to Mitigate CVE-2024-1855
Immediate Actions Required
- Update the WPCafe plugin to the version released in changeset 3084054, which is later than 2.2.23
- Audit WordPress sites for the WPCafe plugin and inventory the installed version across all environments
- On cloud-hosted WordPress instances, enforce IMDSv2 to prevent SSRF-based credential theft from metadata services
Patch Information
The vendor addressed the vulnerability in WordPress changeset 3084054, which modifies core/action/wpc-ajax-action.php to validate the destination URL before issuing the outbound request. Administrators should upgrade WPCafe to the patched release available through the WordPress plugin repository.
Workarounds
- Deactivate the WPCafe plugin until the patched version can be deployed if immediate upgrade is not feasible
- Configure a web application firewall rule to block unauthenticated requests to admin-ajax.php that specify the wpc_check_for_submission action
- Restrict outbound HTTP traffic from the WordPress host to a defined allowlist of destinations required by legitimate plugin functionality
- Block WordPress server access to internal networks and cloud metadata IP ranges using host-based or network firewall rules
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
