Blind Server-Side Request Forgery Vulnerability in Activity Plus Reloaded Plugin for WordPress

CVE-2024-11913

What is CVE-2024-11913?

The Activity Plus Reloaded plugin for WordPress is susceptible to a Blind Server-Side Request Forgery (SSRF) vulnerability within the 'ajax_preview_link' function. This issue impacts all versions up to and including 1.1.1, allowing authenticated users with Subscriber-level privileges or higher to initiate web requests to arbitrary endpoints. Such exploitation can enable attackers to extract or alter sensitive information from internal services, posing significant risks to the integrity and confidentiality of the web application.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References