CVE-2024-6155: CWE-862 Missing Authorization in wpsoul Greenshift – animation and page builder blocks
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshift_download_file_localy function, along with no SSRF protection and sanitization on uploaded SVG files. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application that can also be leveraged to download malicious SVG files containing Cross-Site Scripting payloads to the server. On Cloud-based servers, attackers could retrieve the instance metadata. The issue was partially patched in version 8.9.9 and fully patched in version 9.0.1.
AI Analysis
Technical Summary
CVE-2024-6155 affects the Greenshift – animation and page builder blocks plugin for WordPress, where a missing authorization check in the greenshift_download_file_localy function allows authenticated users (Subscriber+) to initiate SSRF attacks and upload malicious SVG files containing stored XSS payloads. These flaws stem from absent SSRF protections and inadequate sanitization of SVG uploads. Exploitation can lead to arbitrary web requests from the server, including retrieval of cloud instance metadata on cloud-hosted environments. The issue was partially addressed in version 8.9.9 and fully patched in version 9.0.1.
Potential Impact
Authenticated users with Subscriber-level privileges or higher can exploit this vulnerability to make unauthorized server-side web requests and upload malicious SVG files that execute stored cross-site scripting attacks. This could lead to information disclosure, including sensitive internal resources or cloud instance metadata, and potential client-side script execution. There is no indication of impact on availability. The CVSS score is 6.4 (medium severity).
Mitigation Recommendations
Users should upgrade the Greenshift plugin to version 9.0.1 or later, where the vulnerability is fully patched. Versions prior to 9.0.1, including 8.9.9, are vulnerable or only partially fixed. No other mitigations are specified in the advisory. Patch status is confirmed by the vendor's versioning information.
CVE-2024-6155: CWE-862 Missing Authorization in wpsoul Greenshift – animation and page builder blocks
Description
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshift_download_file_localy function, along with no SSRF protection and sanitization on uploaded SVG files. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application that can also be leveraged to download malicious SVG files containing Cross-Site Scripting payloads to the server. On Cloud-based servers, attackers could retrieve the instance metadata. The issue was partially patched in version 8.9.9 and fully patched in version 9.0.1.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-6155 affects the Greenshift – animation and page builder blocks plugin for WordPress, where a missing authorization check in the greenshift_download_file_localy function allows authenticated users (Subscriber+) to initiate SSRF attacks and upload malicious SVG files containing stored XSS payloads. These flaws stem from absent SSRF protections and inadequate sanitization of SVG uploads. Exploitation can lead to arbitrary web requests from the server, including retrieval of cloud instance metadata on cloud-hosted environments. The issue was partially addressed in version 8.9.9 and fully patched in version 9.0.1.
Potential Impact
Authenticated users with Subscriber-level privileges or higher can exploit this vulnerability to make unauthorized server-side web requests and upload malicious SVG files that execute stored cross-site scripting attacks. This could lead to information disclosure, including sensitive internal resources or cloud instance metadata, and potential client-side script execution. There is no indication of impact on availability. The CVSS score is 6.4 (medium severity).
Mitigation Recommendations
Users should upgrade the Greenshift plugin to version 9.0.1 or later, where the vulnerability is fully patched. Versions prior to 9.0.1, including 8.9.9, are vulnerable or only partially fixed. No other mitigations are specified in the advisory. Patch status is confirmed by the vendor's versioning information.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-06-18T21:57:36.542Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6bfcb7ef31ef0b55d549
Added to database: 2/25/2026, 9:39:08 PM
Last enriched: 4/9/2026, 8:05:26 AM
Last updated: 4/12/2026, 4:26:37 PM
Views: 23
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.