CVE-2024-4789 is a Server-Side Request Forgery vulnerability affecting the Cost Calculator Builder Pro plugin for WordPress in all versions up to 3.1.72. The issue resides in the send_demo_webhook() function, allowing authenticated users with subscriber-level privileges or above to induce the server to send HTTP requests to arbitrary locations. This can be leveraged to query or modify information on internal services accessible from the server. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial confidentiality and integrity impact.

Exploitation allows an authenticated user with low privileges to make the server perform arbitrary HTTP requests, which may lead to unauthorized access or modification of internal resources and data leakage. The vulnerability does not directly impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to webhook functionality. Avoid granting unnecessary authenticated access to untrusted users.