CVE-2024-10705 is a Server-Side Request Forgery (SSRF) vulnerability affecting the Multiple Page Generator Plugin – MPG for WordPress, specifically in the 'mpg_download_file_by_link' function. Authenticated users with editor or higher privileges can exploit this flaw to cause the server to make HTTP requests to arbitrary locations. This can be leveraged to interact with internal network services that are otherwise inaccessible externally. The vulnerability affects all versions up to 4.0.5. The CVSS 3.1 base score is 5.4, reflecting a medium impact on confidentiality and integrity, with no impact on availability.

An attacker with editor-level or higher access can abuse this SSRF vulnerability to make the server send requests to arbitrary URLs. This may allow the attacker to access or modify data on internal services that are not exposed externally, potentially leading to information disclosure or unauthorized internal interactions. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict editor-level access to trusted users only and monitor for unusual activity involving the 'mpg_download_file_by_link' function. Avoid exposing sensitive internal services that could be targeted via SSRF.