CVE-2024-56275: 
WordPress vulnerability analysis and mitigation

A Server-Side Request Forgery (SSRF) vulnerability was discovered in the WordPress plugin Envato Elements, affecting versions through 2.0.14. The vulnerability was identified on January 3, 2025, and was assigned CVE-2024-56275. The security flaw affects the Envato Elements WordPress plugin, which is used for accessing photos and Elementor templates (WPScan, Patchstack).

The vulnerability is classified as a Server-Side Request Forgery (SSRF) issue, identified as CWE-918. It received varying CVSS scores from different sources: a CVSS 3.1 Base Score of 4.1 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N according to Patchstack, and a score of 5.5 (medium) according to WPScan (NVD, WPScan).

The vulnerability allows authenticated attackers with Author-level access and above to make web requests to arbitrary locations originating from the web application. This capability can be exploited to query and modify information from internal services, potentially exposing sensitive information of other services running on the system (WPScan, Patchstack).

The vulnerability has been patched in version 2.0.15 of the Envato Elements plugin. Users are advised to update to this version or later to remove the vulnerability. Patchstack users have the option to enable auto-update for vulnerable plugins (Patchstack).