CVE-2024-13905 is a medium severity (CVSS 5.3) server-side request forgery in the OneStore Sites plugin for WordPress, in versions up to and including 0.1.1, through the class-export.php file. Unauthenticated attackers can make the server send requests. Check for a newer release or remove it.
What's affected
- OneStore Sites, all versions up to and including 0.1.1.
The record does not name a fixed version. Check the plugin page and changelog for a release newer than the last affected version before relying on an update.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp plugin list --format=table | grep -i onestore
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Check for a release newer than 0.1.1.
- If none exists, deactivate and delete the plugin.
- Restrict outbound traffic from the web server.
- Look up CVE-2024-13905 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The affected file is a class that exports data, and it is reachable without authentication. The record says an attacker can make web requests to arbitrary locations from the application, which can be used to query and modify information from internal services.
The version number 0.1.1 suggests an early project, so look for signs of maintenance before depending on it.
This CVE is a server-side request forgery flaw (CWE-918, Server-Side Request Forgery). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
Server-side request forgery turns your web application into a proxy. The attacker supplies an address and your server makes the request, from inside your network, with your network permissions.
That matters because internal services often trust anything on the inside. Cloud metadata endpoints, admin panels bound to localhost and internal APIs may all answer a request that would never be allowed from the internet. The defenses are allowlisting the hosts a feature may contact, blocking private and link-local address ranges, and restricting outbound traffic from web servers at the network level.
Quick check
Is login required?
No. The record says unauthenticated attackers can exploit it.
What if there is no fix?
Remove the plugin.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
