Server-Side Request Forgery in Enfold Theme for WordPress

CVE-2024-13695

What is CVE-2024-13695?

The Enfold theme for WordPress is susceptible to a Server-Side Request Forgery (SSRF) vulnerability due to improper validation of the 'attachment_id' parameter. This flaw affects all versions up to and including 6.0.9, enabling authenticated attackers with Subscriber-level access or higher to exploit it. By leveraging this weakness, attackers can initiate web requests to arbitrary destinations, potentially allowing them to interact with and modify internal services beyond the security perimeter of the web application.

References