CVE-2024-5021 is a critical SSRF vulnerability in the nimble3 WordPress Picture / Portfolio / Media Gallery plugin affecting all versions up to 3.0.1. The issue arises from improper handling of external URLs in the 'file_get_contents' function, enabling unauthenticated attackers to induce the server to make arbitrary HTTP requests. This can lead to unauthorized querying and modification of internal services accessible from the server. The vulnerability has a CVSS 3.1 score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact.

An unauthenticated attacker can exploit this SSRF vulnerability to make the server send arbitrary HTTP requests to internal or external systems. This can result in unauthorized disclosure of sensitive information (high confidentiality impact) and limited modification of internal data (low integrity impact). The vulnerability does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates or patches addressing this SSRF vulnerability.