CVE-2024-13856 is a Server-Side Request Forgery vulnerability (CWE-918) in the Your Friendly Drag and Drop Page Builder — Make Builder WordPress plugin, affecting all versions up to and including 1.1.10. The vulnerability exists in the make_builder_ajax_subscribe() function, allowing authenticated users with at least Subscriber privileges to induce the server to make HTTP requests to arbitrary locations. This can be leveraged to access or manipulate internal services not directly accessible to the attacker. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact.

An attacker with Subscriber-level access or higher can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests. This may lead to unauthorized querying or modification of internal services and data accessible from the server environment. The impact includes limited confidentiality and integrity loss but no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user capabilities if possible and monitor for suspicious activity related to the plugin. Avoid granting unnecessary privileges to untrusted users. Follow the vendor's updates for any forthcoming patches or official mitigations.