CVE-2020-24142 - CVE House
Back to Database
Status published Critical CVE-2020-24142

Server-side request forgery in the Video Downloader for TikTok (aka...

Vulnerability Description

Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hosts and execute command on services

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-24142

Credits & Attribution

No credits recorded in the NVD database.

References

More from ninjateam

View All →
CVE-2025-6986
FileBird – WordPress Media Library Folders & File Manager <= 6.4.8 - Authenticated (Author+) SQL Injection
Medium 6.5
CVE-2025-5236
NinjaTeam Chat for Telegram <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter
Medium 6.4
CVE-2025-3234
File Manager Pro – Filester <= 1.8.8 - Authenticated (Administrator+) Arbitrary File Upload
High 7.2
CVE-2025-1672
Notibar <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium 5.5
CVE-2025-14001
WP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication
Medium 5.4

Affected Vendor

Affected Software

video downloader for tiktok
Vulnerable Versions:
1.3

Timeline

Official Publish: July 7th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.