The Modern Events Calendar plugin for WordPress contains a Server-Side Request Forgery vulnerability (CWE-918) identified as CVE-2024-6522. This flaw exists in all versions up to and including 7.12.1 within the 'mec_fes_form' AJAX function. Authenticated attackers with at least Subscriber privileges can abuse this vulnerability to cause the server to make arbitrary HTTP requests to internal or external resources. The CVSS 3.1 base score is 8.5, indicating a high severity with network attack vector, low attack complexity, and privileges required at the low level. The impact includes high confidentiality loss and limited integrity loss, with no availability impact. There is no cloud service aspect, and no patch or official remediation guidance is currently documented in the provided information.

An attacker with Subscriber-level or higher access can exploit this SSRF vulnerability to make the server send arbitrary HTTP requests. This can lead to unauthorized access or modification of internal services or data accessible from the server, resulting in a high confidentiality impact and some integrity impact. Availability is not affected. The vulnerability could be leveraged to gather sensitive information or manipulate internal systems that are otherwise inaccessible externally.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to trusted users only and monitor for suspicious activity involving the 'mec_fes_form' AJAX endpoint. Consider disabling or limiting access to the affected functionality if possible. Avoid granting Subscriber-level or higher access to untrusted users.