CVE-2024-1978 is a Server-Side Request Forgery vulnerability (CWE-918) in the Friends WordPress plugin by akirk, affecting all versions up to 2.8.5. Authenticated attackers with administrator privileges can leverage the discover_available_feeds function to induce the server to send crafted HTTP requests to arbitrary internal or external locations. This can potentially allow attackers to access or modify information from internal services that are otherwise inaccessible externally. The vulnerability has a CVSS 3.1 score of 5.5, reflecting medium impact with low complexity and requiring high privileges.

An attacker with administrator-level access can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests. This may lead to unauthorized querying and modification of internal services, potentially exposing sensitive information or altering internal data. However, exploitation requires high privileges (administrator or above), limiting the scope of impact to trusted users who have already compromised or legitimately hold elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor the vendor's communications for updates. Until a fix is available, restrict administrator access to trusted users only and consider disabling or removing the Friends plugin if it is not essential.