The Task Scheduler WordPress plugin contains a blind server‑side request forgery flaw that can be triggered via the “Check Website” task. When a user with Administrator privileges or higher invokes this task, the plugin sends HTTP requests to an arbitrary host originating from the web server. The attacker can query or modify information on internal services reachable from the server, effectively turning the web application into an internal network probe.

The affected software is the Task Scheduler plugin developed by miunosoft for WordPress. Versions up to and including 1.6.3 are vulnerable. The issue arises from all releases prior to the 1.6.4 update, where the logic for the “Check Website” task was not secured against arbitrary URLs.

The CVSS score of 4.4 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw requires Administrator‑level access, it cannot be leveraged by unauthenticated or low‑privilege users. The primary attack vector is an internal network request from the WordPress server, allowing reconnaissance or manipulation of internal services that are reachable from the server. Overall, the threat level is low to moderate, but patching is recommended to close the blind SSRF channel.