Activity Plus Reloaded for BuddyPress Blind Server-Side Request Forgery Vulnerability

A Blind Server-Side Request Forgery (SSRF) vulnerability has been identified in the Activity Plus Reloaded for BuddyPress plugin for WordPress, affecting all versions through 1.1.1. This vulnerability allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary locations from the web application, potentially querying and modifying information from internal services.

Impact

Exploitation of this vulnerability could lead to unauthorized web requests being made from the server, allowing attackers to interact with internal services or resources, which could be used to query or modify sensitive information.

Remediation

Users are advised to update the Activity Plus Reloaded for BuddyPress plugin to version 1.1.2 or a newer patched version.