CVE-2024-11638

Gtbabel < 6.6.9 - Unauthenticated Admin Account Takeover

The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user (such as admin) cookies by making them open a crafted URL as the request made to analysed the URL contains such cookies.

Affected

Gtbabel

CVSS v3.1 CNA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.56% chance of exploitation in the next 30 days, 45th percentile

Published

2025-03-10

Updated

2025-08-27

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/2f20336f-e12e-4b09-bcaf-45f7249f6495/

Security advisories

• https://wpscan.com/vulnerability/2f20336f-e12e-4b09-bcaf-45f7249f6495

References

• CVE Record
• NVD entry