CVE-2024-13411

The Zapier for WordPress plugin contains a server-side request forgery vulnerability affecting versions 1.5.1 and earlier through its updated_user() function. Attackers with subscriber-level or higher privileges can exploit this flaw to send web requests from the server to arbitrary destinations, potentially allowing them to access and modify data on internal services. The vulnerability requires user authentication to exploit but poses a significant risk to systems with internal services accessible from the web server.

Based on public CVE data (MITRE/NVD).