CVE-2024-1758 is a Server-Side Request Forgery vulnerability in the SuperFaktura WooCommerce plugin for WordPress affecting all versions up to and including 1.40.3. The vulnerability arises from the wc_sf_url_check function, which does not properly restrict URLs that authenticated users with subscriber-level permissions can request. This allows these users to make arbitrary HTTP requests originating from the web application, potentially accessing or modifying internal services. The vulnerability has a CVSS 3.1 base score of 5.4, reflecting a medium impact on confidentiality and integrity but no impact on availability. No official patch or remediation is currently documented.

An attacker with subscriber-level access or higher can exploit this SSRF vulnerability to make arbitrary web requests from the server hosting the plugin. This could allow the attacker to access or modify information from internal services that are otherwise inaccessible externally. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to the plugin. Avoid exposing sensitive internal services that could be targeted via SSRF.