CVE-2024-13924 is a medium severity (CVSS 5.3) blind server-side request forgery in the Starter Templates by FancyWP plugin for WordPress, in versions up to and including 2.0.0, via the http_request_host_is_external filter. Update past 2.0.0 or remove the plugin. Check the changelog for the fixed release.
What's affected
- Starter Templates by FancyWP, all versions up to and including 2.0.0.
The record does not name a fixed version. Check the plugin page and changelog for a release newer than the last affected version before relying on an update.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp plugin list --format=table | grep -i fancywp
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Check for a release newer than 2.0.0.
- If you only used it to import a starter site, deactivate and delete it once the import is done.
- Restrict outbound traffic from the web server.
- Look up CVE-2024-13924 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The record points at the http_request_host_is_external filter, which WordPress uses to decide whether an outgoing request host is allowed. A plugin that changes that decision can weaken a built-in protection for the whole site.
Starter template plugins are often needed once and then left installed. Removing them after setup closes the exposure completely.
This CVE is a server-side request forgery flaw (CWE-918, Server-Side Request Forgery). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
Server-side request forgery turns your web application into a proxy. The attacker supplies an address and your server makes the request, from inside your network, with your network permissions.
That matters because internal services often trust anything on the inside. Cloud metadata endpoints, admin panels bound to localhost and internal APIs may all answer a request that would never be allowed from the internet. The defenses are allowlisting the hosts a feature may contact, blocking private and link-local address ranges, and restricting outbound traffic from web servers at the network level.
Quick check
What is the filter?
A WordPress hook that controls whether a request host counts as external.
Is it safe to remove after import?
Usually yes, but check that no feature of your site depends on it.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
