B Carousel Block Server-Side Request Forgery Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the B Carousel Block – Responsive Image and Content Carousel plugin for WordPress, affecting versions through 1.1.5. The vulnerability arises because the plugin fails to validate user-supplied URLs before sending them via the wp_remote_request() function. This flaw allows authenticated attackers with subscriber-level access and above to make web requests to arbitrary locations from the web application, potentially querying and modifying information from internal services.

Impact

Exploitation of this vulnerability allows for Server-Side Request Forgery, enabling authenticated attackers to make requests to internal services from the web application.

Remediation

Users are advised to update the B Carousel Block – Responsive Image and Content Carousel plugin to version 1.1.6 or later.