The Carousel Block plugin fails to validate user‑supplied URLs before passing them to wp_remote_request, allowing any authenticated user with subscriber level or higher to send arbitrary HTTP requests from the WordPress server. This can expose internal services or retrieve sensitive data, and also enables the attacker to modify internal resources or initiate further attacks. The weakness directly corresponds to CWE‑918.

The vulnerability applies to the WordPress plugin B Carousel Block – Responsive Image and Content Carousel for versions up to and including 1.1.5. WordPress sites running any of these versions with the plugin installed are at risk whenever users possessing subscriber or higher roles can add or edit carousel blocks.

The CVSS score of 6.4 indicates moderate severity and the EPSS score of less than 1% suggests a low probability of exploitation; the vulnerability is not listed in the CISA KEV catalog. Because an attacker must first authenticate to the WordPress admin area as a subscriber or above, the attack surface is limited to privileged users. Once authenticated, the attacker can craft a carousel entry with a malicious URL, causing the server‑side wp_remote_request to reach arbitrary hosts—including internal network resources—without validation or redirection checks. This makes the issue straightforward to exploit in a controlled environment, but the low EPSS indicates active exploitation is currently uncommon.