The Emplibot plugin for WordPress contains a Server‑Side Request Forgery vulnerability that allows an authenticated user with Administrator privileges to trigger HTTP requests from the server to arbitrary URLs. By calling the exposed emplibot_call_webhook_with_error() and emplibot_process_zip_data() functions, an attacker can query internal services or perform write operations against them. This weakness is a direct result of CWE‑918 and can lead to unauthorized data disclosure or modification inside the hosting environment.

The vulnerability applies to Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated plugin for WordPress versions up to and including 1.0.9. Any WordPress site that has installed this plugin and has users with Administrator level or higher access is at risk.

The CVSS score of 4.4 indicates low severity, but the attack requires privileged access and originates from an authenticated session, limiting the threat surface. The EPSS score is below 1%, suggesting a very low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Since the attacker must be authenticated, a successful exploitation path would involve gaining legitimate admin credentials and then invoking the vulnerable functions to reach internal resources.