CVE-2024-1978
CVSS 3.1 Score 5.5 of 10 (medium)
Details
Published Feb 29, 2024
Summary
CVE-2024-1978 is a Server-Side Request Forgery vulnerability affecting the Friends plugin for WordPress. This issue, present in all versions up to 2.8.5, allows authenticated attackers with administrator-level access or higher to issue web requests to arbitrary locations from within the application. Consequently, attackers can potentially query and manipulate data from internal services, posing a significant security risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.