CVE-2024-32775: 
WordPress vulnerability analysis and mitigation

A Server-Side Request Forgery (SSRF) vulnerability was discovered in the WordPress Embed Google Photos album plugin, affecting versions up to 2.1.9. The vulnerability was reported on January 20, 2024, and publicly disclosed on April 22, 2024 (Patchstack).

The vulnerability has been assigned CVE-2024-32775 and received a CVSS v3.1 score of 4.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and requires Contributor-level privileges or higher to exploit (Patchstack).

The SSRF vulnerability could allow a malicious actor to cause a website to execute website requests to an arbitrary domain of the attacker's choosing. This could potentially lead to the discovery of sensitive information from other services running on the system (Patchstack).

The vulnerability requires authenticated access with Contributor-level privileges or higher. It has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been patched in version 2.2.1 of the plugin. Users are advised to update to version 2.2.1 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack).