Unauthenticated Attackers Can Abuse 'file_get_contents' Function in WordPress Picture/Portfolio/Media Gallery Plugin

CVE-2024-5021

What is CVE-2024-5021?

The Nimble Portfolio plugin for WordPress is susceptible to a Server-Side Request Forgery vulnerability in all versions up to and including 3.0.1. This issue arises from how the plugin utilizes the 'file_get_contents' function, allowing unauthenticated attackers to craft malicious web requests to arbitrary locations. The exploitation of this flaw can lead to unauthorized querying and modification of information from internal services, posing serious risks to the security and integrity of affected web applications.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References