Critical severity9.3NVD Advisory· Published Jun 19, 2024· Updated Apr 15, 2026

CVE-2024-5021

Description

The WordPress Picture / Portfolio / Media Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.1 via the 'file_get_contents' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

plugins.trac.wordpress.org/browser/nimble-portfolio/trunk/includes/prettyphoto/download-image.phpnvd
www.wordfence.com/threat-intel/vulnerabilities/id/224a2d6d-7fdc-43a8-a8c9-26213b604433nvd

News mentions

No linked articles in our index yet.

cvss	0.605
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000