Blind Server-Side Request Forgery Vulnerability in Activity Plus Reloaded Plugin for WordPress

CVE-2024-11913

What is CVE-2024-11913?

The Activity Plus Reloaded plugin for WordPress is susceptible to a Blind Server-Side Request Forgery (SSRF) vulnerability within the 'ajax_preview_link' function. This issue impacts all versions up to and including 1.1.1, allowing authenticated users with Subscriber-level privileges or higher to initiate web requests to arbitrary endpoints. Such exploitation can enable attackers to extract or alter sensitive information from internal services, posing significant risks to the integrity and confidentiality of the web application.

References