CVE-2020-24142

CVE-2020-24142 describes a critical server-side request forgery (SSRF) vulnerability in the Video Downloader for TikTok plugin 1.3 for WordPress, specifically affecting products from ninjateam. An unauthenticated attacker can exploit this by manipulating the njt-tk-download-video parameter, enabling them to send crafted requests from the vulnerable server. This allows for reconnaissance activities like identifying open ports and local network hosts, and potentially executing commands on services, leading to high impact on confidentiality, integrity, and availability, as reflected by its CVSS score of 9.8 (Critical). Despite its severity, there is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.