The Local Syndication plugin allows any authenticated user with Contributor level or higher to insert the [syndicate_local] shortcode with a custom url parameter. The plugin calls wp_remote_get() instead of the safer wp_safe_remote_get(), meaning the request is not filtered against internal or private IP ranges. This flaw permits an attacker to trigger outbound HTTP requests from the WordPress server to arbitrary internal or external hosts. The attacker can consequently read sensitive data from internal services, modify internal state, or use the server as a pivot to scan the internal network, thereby compromising confidentiality, integrity, and potentially availability of networked resources.

WordPress sites running the willbontrager Local Syndication plugin, versions 1.5a and earlier, are affected. The vulnerability applies regardless of the specific WordPress core version, provided the plugin is installed and the user has Contributor or higher access rights.

The CVSS score of 6.4 indicates a medium severity vulnerability. The EPSS score of less than 1 implies that, at the time of this assessment, exploitation is very unlikely to occur. The vulnerability is not listed in the CISA KEV catalog. It is likely that exploitation would require an authenticated user with Contributor privileges, so the attack vector is limited to internal accounts. Once authenticated, the attacker can supply arbitrary URLs to the shortcode, enabling SSRF without needing to bypass any additional firewall rules beyond what meets local policy.