CVE-2024-4354

CVE-2024-4354 is a Server-Side Request Forgery (SSRF) vulnerability affecting all versions up to and including 2.3 of the TablePress – Tables in WordPress made easy plugin. Authenticated attackers with author-level access or higher can exploit this to make arbitrary web requests from the application, potentially querying or modifying internal service information. The vulnerability has a CVSS score of 6.4 (MEDIUM) with a vector indicating network-based attacks with low complexity and low privileges, leading to low confidentiality and integrity impacts. While the developer has restricted the vulnerable functionality to administrators, this is considered a suboptimal solution. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules for Metasploit or Nuclei, or entries in ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness.