CVE-2024-13695 is a Server-Side Request Forgery vulnerability (CWE-918) affecting the Enfold - Responsive Multi-Purpose Theme for WordPress in all versions up to and including 6.0.9. The flaw exists in the handling of the 'attachment_id' parameter, allowing authenticated users with at least Subscriber privileges to induce the server to make arbitrary HTTP requests. This can lead to unauthorized querying or modification of internal services accessible from the web application server. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting a medium severity with low attack complexity and partial confidentiality and integrity impact.

An attacker with authenticated access at Subscriber level or above can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests. This may allow the attacker to access or modify information from internal services that are not directly accessible externally. The impact includes partial confidentiality and integrity loss but no availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's announcements for updates. Until a fix is available, restrict Subscriber-level user capabilities if possible and consider additional access controls or web application firewall rules to limit SSRF exploitation via the 'attachment_id' parameter.