The Icon List Block – Add Icon-Based Lists with Custom Styles plugin for WordPress contains a Server‑Side Request Forgery flaw. The vulnerable fs_api_request function permits authenticated users with Subscriber or higher privileges to send HTTP requests to arbitrary URLs from the host, allowing them to read from or manipulate internal network services. Because the response is filtered to only valid JSON, the attacker can still consume sensitive data or trigger actions on internal systems without immediate visible error.

WordPress installations running any version of the Icon List Block plugin up to and including 1.2.1 are affected. The vulnerability exists in all checked releases of the plugin’s code base; any site that has not updated beyond 1.2.1 remains at risk.

The CVSS base score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The issue is not in the CISA KEV catalog. Nonetheless, exploitation requires only legitimate Subscriber‑level credentials, so the risk surface is limited to sites that grant such permissions. An attacker could use the flaw to exfiltrate internal data or alter services, manipulating the web application’s internal network view.