CVE-2024-13879 is a Server-Side Request Forgery (SSRF) vulnerability in the Stream WordPress plugin (xwp Stream) affecting all versions up to 4.0.2. The issue arises from insufficient validation of URLs in the webhook feature, allowing authenticated administrators to induce the server to send HTTP requests to arbitrary locations. This can be leveraged to interact with internal services that are otherwise inaccessible externally, potentially leading to unauthorized information disclosure or modification. The vulnerability requires high privileges (administrator or above) and does not involve user interaction. The CVSS 3.1 base score is 5.5, reflecting medium severity with network attack vector, low complexity, high privileges required, and partial confidentiality and integrity impact.

An attacker with administrator-level access can exploit this SSRF vulnerability to make arbitrary HTTP requests from the server, potentially accessing or modifying internal services that are not directly exposed to the internet. This could lead to unauthorized information disclosure or alteration within the internal network environment. There is no indication of availability impact or known exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to webhook configurations. Avoid exposing sensitive internal services that could be targeted via SSRF. Follow vendor updates closely for an official patch or mitigation instructions.