CVE-2024-13845: 
WordPress vulnerability analysis and mitigation

The Gravity Forms WebHooks plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2024-13845) affecting all versions up to and including 1.6.0. The vulnerability was discovered in the 'processfeed' method of the GFWebhooks class and was patched in version 1.7.0, released in April 2025 (Gravity Forms Blog, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. The issue is classified as CWE-918 (Server-Side Request Forgery) and requires administrator-level access or higher privileges to exploit (NVD, Wiz).

When exploited, this vulnerability allows authenticated attackers with administrator-level access to make web requests to arbitrary locations originating from the web application. This capability can be leveraged to query and modify information from internal services (NVD).

The vulnerability has been patched in version 1.7.0 of the Gravity Forms WebHooks Add-On. Users are advised to update to this version immediately. The update includes security enhancements credited to Francesco Carlucci via WordFence (Gravity Forms Blog).