CVE-2024-4404 is a Server-Side Request Forgery vulnerability (CWE-918) in the ElementsKit PRO WordPress plugin (versions up to 3.6.2). It allows authenticated users with contributor-level or higher permissions to leverage the 'render_raw' function to cause the server to make arbitrary HTTP requests. This can be abused to interact with internal network services or other unintended targets, potentially leading to information disclosure or limited modification of internal resources. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact.

An attacker with contributor-level or higher permissions can exploit this SSRF vulnerability to make the server send arbitrary HTTP requests. This can lead to unauthorized querying and modification of internal services accessible from the server, resulting in potential information disclosure and limited integrity impact. The vulnerability does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level user permissions to trusted users only and monitor for suspicious activity related to the 'render_raw' function. Avoid exposing sensitive internal services accessible from the web server. Follow updates from the vendor wpmet for an official patch or mitigation instructions.