Unauthenticated Attackers Can Abuse 'file_get_contents' Function in WordPress Picture/Portfolio/Media Gallery Plugin

CVE-2024-5021

What is CVE-2024-5021?

The Nimble Portfolio plugin for WordPress is susceptible to a Server-Side Request Forgery vulnerability in all versions up to and including 3.0.1. This issue arises from how the plugin utilizes the 'file_get_contents' function, allowing unauthenticated attackers to craft malicious web requests to arbitrary locations. The exploitation of this flaw can lead to unauthorized querying and modification of information from internal services, posing serious risks to the security and integrity of affected web applications.

References