CVE-2024-2663: 
WordPress vulnerability analysis and mitigation

The ZD YouTube FLV Player plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability affecting all versions up to and including 1.2.6. The vulnerability was disclosed and the plugin was subsequently closed on March 20, 2024, due to security concerns (WordPress Plugin, NVD Database).

The vulnerability exists in the $_GET['image'] parameter, which allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application. The severity of this vulnerability has been assessed with a CVSS v3.1 Base Score of 8.3 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L (Wordfence Intel).

The vulnerability enables attackers to query and modify information from internal services. As an SSRF vulnerability, it could potentially allow attackers to bypass network security controls and access internal resources that should not be accessible from the external network (NVD Database).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (Wordfence Intel).

The plugin has been closed and is no longer available for download as of March 20, 2024. Users are advised to immediately remove this plugin from their WordPress installations as there are no patches available (WordPress Plugin).