CVE-2024-1758 is a medium severity (CVSS 5.4) server-side request forgery in the SuperFaktura WooCommerce plugin for WordPress, in all versions up to and including 1.40.3. Authenticated users with subscriber access or higher can abuse it. Update the plugin to a release that postdates 1.40.3 and confirm the exact fixed version in the plugin changelog.
What's affected
SuperFaktura WooCommerce for WordPress, all versions up to and including 1.40.3. The record names the function wc_sf_url_check as the place where the problem lives, and the weakness class is CWE-918, server-side request forgery.
The description says attackers need an account with subscriber level access or above. On a store that allows customer registration, that bar is low, because every shopper can usually get an account.
The record does not name a fixed version. The references point to a WordPress plugin repository changeset and a Wordfence entry, but the Wordfence page could not be retrieved when this post was written. Treat 1.40.4 or later as a reasonable target only after you read the changelog yourself.
The description also notes that CVE-2024-32803 appears to be a duplicate of this issue. If your scanner reports both, handle them as one fix.
How to check if you're exposed
If you have WP-CLI on the server, list the plugin and its version:
wp plugin list --name=woocommerce-superfaktura --fields=name,status,version,update
Without WP-CLI, open Plugins in the WordPress admin and read the version under SuperFaktura WooCommerce. Anything at 1.40.3 or lower is in the affected range.
Then ask a second question: who can register? If your shop allows open account creation, treat every registered customer as a potential caller of the vulnerable function. If registration is closed and you trust all subscribers, your practical exposure is smaller, though the version is still affected.
The free in-browser dependency scan will not inspect a WordPress plugin directory, but it can check the Composer and npm manifests in your own theme or custom code.
What to do now
- Run the WP-CLI command above, or check the Plugins screen, and record the installed version.
- Update the plugin from the WordPress dashboard or with wp plugin update woocommerce-superfaktura, then read the changelog to confirm the SSRF fix is listed.
- If an update is not yet available, deactivate the plugin or restrict new account registration until it is.
- Review which accounts exist at subscriber level and remove any you do not recognise.
- Check outbound firewall rules on the web server. A shop server rarely needs to reach internal admin interfaces or cloud metadata addresses, and blocking those limits what any SSRF can reach.
Why it matters
Server-side request forgery makes your server the one that sends a request. The request carries your server's network position, so a caller can reach services that are not exposed to the internet, such as internal admin panels or cloud metadata endpoints. The description says the flaw can be used to query and modify information from internal services.
The rating is medium because the attacker must be logged in and the described impact on confidentiality and integrity is low. That score reflects the plugin alone. On a server that sits next to sensitive internal services, the real impact can be larger. The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing I retrieved says it is exploited in the wild.
The general defence is to validate any URL the server is asked to fetch against an allowlist of hosts and to block private address ranges.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need an account?
Yes. The description says subscriber level access or above is required, so the caller must be logged in.
Is this being exploited in the wild?
Nothing in the record says so, and the CISA Known Exploited Vulnerabilities flag is false. Patch on your normal urgent schedule rather than as an emergency.
Sources
- NVD record for CVE-2024-1758
- Plugin source reference listed in the record
- Wordfence entry listed in the record (not retrievable when reviewed)
Last reviewed: 19 October 2026.
