CVE-2024-37942: Berqier Berqwp SSRF Vulnerability

CVE-2024-37942 Overview

CVE-2024-37942 is a Server-Side Request Forgery (SSRF) vulnerability affecting the BerqWP WordPress plugin developed by Berqier Ltd. The flaw exists in all plugin versions up to and including 1.7.5. According to the Patchstack advisory, this is an unauthenticated, non-blind SSRF, meaning attackers do not need credentials to trigger requests from the vulnerable server and can observe responses. The weakness is classified under CWE-918 (Server-Side Request Forgery).

Critical Impact
Unauthenticated attackers can coerce the WordPress server to issue arbitrary HTTP requests, enabling internal network reconnaissance, access to cloud metadata services, and interaction with internal-only services.

Affected Products

BerqWP WordPress plugin versions up to and including 1.7.5
WordPress sites running the berqier/berqwp plugin
Hosting environments exposing internal services reachable from the WordPress host

Discovery Timeline

2024-07-22 - CVE-2024-37942 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37942

Vulnerability Analysis

The BerqWP plugin accepts user-controlled URLs and uses them as targets for outbound HTTP requests from the WordPress server. Because the plugin does not validate or restrict the destination of these requests, an unauthenticated attacker can supply arbitrary URLs. The server then performs the request on the attacker's behalf and returns response data, making this a non-blind SSRF. Attackers can reach internal IP ranges, loopback interfaces, and cloud provider metadata endpoints such as 169.254.169.254. The Exploit Prediction Scoring System places this issue in the lower end of expected exploitation likelihood, but the unauthenticated network attack surface makes it a practical risk for any exposed WordPress site running the plugin.

Root Cause

The root cause is missing validation of user-supplied URL input before it is passed to an outbound HTTP request function. The plugin does not enforce an allowlist of hosts, does not reject private or link-local address ranges, and does not restrict permitted URL schemes. This matches the CWE-918 pattern where remote input directly drives server-initiated requests.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the vulnerable BerqWP endpoint containing a target URL parameter. The plugin issues a request to that URL using the WordPress server's network position and returns the response body to the attacker. Common abuse targets include internal admin panels, container orchestration APIs, database management UIs, and cloud instance metadata services that issue temporary credentials. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-37942

Indicators of Compromise

Outbound HTTP requests from the WordPress host targeting private RFC1918 ranges, 127.0.0.1, or 169.254.169.254
Web server access logs showing unauthenticated requests to BerqWP plugin endpoints containing URL parameters
Unexpected egress connections from the PHP-FPM or web server process to internal services
Cloud audit logs showing instance metadata service (IMDS) access originating from the WordPress workload

Detection Strategies

Inspect web server logs for requests to /wp-content/plugins/berqwp/ or BerqWP AJAX actions containing http://, https://, or file:// parameter values
Correlate inbound HTTP requests with outbound connections from the WordPress process to detect SSRF chains
Alert on any WordPress workload issuing requests to cloud metadata IPs, which should never occur in normal plugin behavior

Monitoring Recommendations

Enable egress filtering and log all outbound connections from WordPress hosts at the network layer
Monitor WordPress plugin inventory and flag installations of berqwp at or below version 1.7.5
Forward web server, PHP, and network flow logs to a centralized analytics platform for cross-source correlation

How to Mitigate CVE-2024-37942

Immediate Actions Required

Identify all WordPress installations running the BerqWP plugin and confirm the installed version
Update BerqWP to a version released after 1.7.5 that addresses the SSRF condition
Restrict outbound network access from WordPress hosts to only required destinations
On cloud workloads, enforce IMDSv2 to require session tokens for instance metadata access

Patch Information

Update BerqWP to a release later than 1.7.5. Consult the Patchstack Vulnerability Report for the fixed version and vendor guidance. Confirm the upgrade in the WordPress admin under Plugins and verify the plugin version matches the patched release.

Workarounds

Deactivate and remove the BerqWP plugin until a patched version is installed
Deploy a web application firewall rule that blocks BerqWP endpoint requests containing URL parameters referencing internal address ranges
Block outbound traffic from the WordPress host to 169.254.169.254, 127.0.0.0/8, and RFC1918 ranges except where explicitly required

bash

# Example egress restriction using iptables to block IMDS access from the WordPress host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner www-data -j DROP