CVE-2024-54330 Overview
CVE-2024-54330 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting the Hurrakify WordPress plugin developed by hurraki. The flaw impacts all versions up to and including 2.4. Attackers can abuse the plugin to coerce the WordPress server into issuing arbitrary outbound HTTP requests to attacker-controlled or internal-only destinations.
The vulnerability is network-exploitable, requires no authentication, and needs no user interaction. The Exploit Prediction Scoring System (EPSS) rates this issue at 72.529% with a percentile of 98.784, indicating a high probability of exploitation activity relative to other published CVEs.
Critical Impact
Unauthenticated attackers can pivot through vulnerable WordPress hosts to reach internal services, cloud metadata endpoints, and otherwise unreachable network resources.
Affected Products
- Hurrakify WordPress plugin versions through 2.4
- WordPress sites running the hurraki Hurrakify extension
- Hosting environments exposing the plugin endpoint to untrusted networks
Discovery Timeline
- 2024-12-13 - CVE-2024-54330 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2024-54330
Vulnerability Analysis
The Hurrakify plugin accepts a user-controlled URL or host parameter and passes it to a server-side HTTP request function without sufficient validation. Because the destination is not constrained to a safe allowlist, the WordPress backend will fetch arbitrary URLs on behalf of the attacker. This grants the attacker the network identity and trust context of the WordPress host.
SSRF in WordPress plugins is commonly used to reach internal IPv4 ranges such as 127.0.0.1, 10.0.0.0/8, and 169.254.169.254. The last address exposes cloud instance metadata services on AWS, Azure, and GCP, which can leak temporary credentials. The Common Weakness Enumeration entry CWE-918 describes this class of failure.
Root Cause
The plugin performs server-side fetches without validating the scheme, host, or resolved IP address of the supplied URL. There is no allowlist of permitted destinations and no filtering of private, loopback, or link-local address ranges. The fetch routine returns either content or side-channel signals such as timing and status codes, both of which enable reconnaissance.
Attack Vector
An unauthenticated remote attacker sends a crafted HTTP request to a vulnerable plugin endpoint exposed by the WordPress installation. The request includes a target URL pointing to an internal service, cloud metadata API, or attacker-controlled logging endpoint. The WordPress server initiates the outbound request, and the response or its observable behavior is returned to the attacker.
No verified public proof-of-concept code is referenced for this CVE. See the Patchstack SSRF Vulnerability Advisory for advisory details.
Detection Methods for CVE-2024-54330
Indicators of Compromise
- Outbound HTTP requests from the WordPress PHP worker to internal RFC1918 addresses or 169.254.169.254.
- Web access logs containing plugin endpoint hits with URL-shaped query parameters originating from unfamiliar source IPs.
- Unexpected DNS lookups from the web server to attacker-controlled domains used for SSRF callback confirmation.
- Cloud audit logs showing the WordPress host querying instance metadata endpoints outside normal patterns.
Detection Strategies
- Inspect WordPress access logs for requests to Hurrakify plugin paths containing parameters that resemble URLs or IP addresses.
- Correlate inbound HTTP requests with subsequent outbound connections from the same PHP process within a short time window.
- Alert on any web server process initiating connections to private IP ranges, loopback, or link-local addresses.
Monitoring Recommendations
- Forward WordPress, web server, and egress firewall logs to a centralized analytics platform for correlation.
- Monitor cloud metadata service access from web tiers and treat any non-baseline access as high priority.
- Track plugin inventory and version data across WordPress fleets to identify hosts still running Hurrakify <= 2.4.
How to Mitigate CVE-2024-54330
Immediate Actions Required
- Identify all WordPress instances running the Hurrakify plugin and confirm the installed version.
- Disable or uninstall the Hurrakify plugin on any host running version 2.4 or earlier until a fixed release is verified.
- Restrict outbound network access from WordPress hosts to only the destinations required for normal operation.
- Enforce IMDSv2 on AWS workloads to limit credential theft via SSRF against the metadata service.
Patch Information
At the time of NVD publication, the advisory lists affected versions up to and including 2.4 and does not confirm a fixed version. Consult the Patchstack SSRF Vulnerability Advisory for the latest remediation guidance and any vendor-issued update.
Workarounds
- Block the vulnerable Hurrakify endpoints at the web application firewall until a patched release is deployed.
- Apply egress filtering on the WordPress host to deny traffic to RFC1918, loopback, and 169.254.169.254 ranges.
- Run WordPress in a network segment that cannot reach internal management interfaces or cloud metadata services.
- Remove the plugin entirely if it is not essential to site functionality.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
