What’s Vulnerable › Vulnerabilities

CVE-2024-13879: Stream <= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgery

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-17 · updated 2026-06-17
• Weakness: CWE-918

Description

The Stream plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.2 due to insufficient validation on the webhook feature. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Affected products

• XWP Stream: through 4.0.2

References

• https://github.com/xwp/stream/blob/develop/changelog.md#410---january-15-2025
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226637%40stream&new=3226637%40stream&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8680ad0a-7513-408d-a62d-ffb0b0e7addb?source=cve

Get alerted when CVE-2024-13879 or the next vulnerability affects your stack