The AI Power: Complete AI Pack WordPress plugin (renamed AI Puffer) contains a Server-Side Request Forgery vulnerability identified as CVE-2024-13360. This vulnerability exists in all versions up to and including 1.8.96 and is exploitable through the wpaicg_troubleshoot_add_vector() function. An authenticated attacker with at least subscriber privileges can leverage this SSRF flaw to make arbitrary HTTP requests from the web server to internal or external systems. This can lead to unauthorized querying or modification of internal services. The CVSS 3.1 base score is 5.4, reflecting medium severity with low attack complexity and limited impact on confidentiality and integrity but no impact on availability. There is no indication of known exploits in the wild or vendor-provided patches at this time.

An attacker with subscriber-level access or higher can exploit this SSRF vulnerability to make arbitrary HTTP requests from the server hosting the WordPress plugin. This could allow unauthorized access to internal services or modification of information accessible from the server's network context. The impact is limited to confidentiality and integrity with no direct availability impact. The medium CVSS score reflects these moderate risks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user capabilities if possible and monitor for suspicious activity related to the wpaicg_troubleshoot_add_vector() function. Avoid granting unnecessary privileges to users and consider disabling or removing the plugin if not essential.