CVE-2024-6584 – Jetpack Boost <= 3.4.6 - Authenticated (Admin+) Server-Side Request Forgery

https://notcve.org/view.php?id=CVE-2024-6584

The Jetpack Boost – Website Speed, Performance and Critical CSS plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.6 via the wp_ajax_boost_proxy_ig AJAX action. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. • CWE-918: Server-Side Request Forgery (SSRF) •