CVE-2024-11913 is a Blind SSRF vulnerability in the Activity Plus Reloaded for BuddyPress WordPress plugin affecting all versions up to 1.1.1. The flaw exists in the 'ajax_preview_link' function, allowing authenticated users with at least Subscriber privileges to induce the server to send HTTP requests to arbitrary locations. This can be leveraged to interact with internal services that are otherwise inaccessible externally. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.4 (Network attack vector, low attack complexity, low privileges required, no user interaction, impacts confidentiality and integrity).

Exploitation allows authenticated users with Subscriber-level access or higher to cause the server to make arbitrary HTTP requests. This can lead to unauthorized querying or modification of internal services and data accessible from the server environment. The impact affects confidentiality and integrity but does not affect availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit plugin usage to trusted users with appropriate privileges and consider disabling or restricting the vulnerable functionality if possible.