The vulnerability resides in the pixabayDownloadImage function of the Xagio SEO – AI Powered SEO WordPress plugin, allowing an authenticated user with Subscriber level privileges or higher to trigger outbound HTTP requests from the server. This Server‑Side Request Forgery can be used to retrieve sensitive information or alter data in internal systems, thereby compromising confidentiality and integrity. The flaw does not require elevated privileges beyond the defined role, so any logged‑in subscriber may exploit it.

All installations of the Xagio SEO – AI Powered SEO plugin up to and including version 7.1.0.30 are affected. The plugin is distributed by xagio and installed within the WordPress ecosystem. Versions newer than 7.1.0.30 are presumed corrected.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The plugin is not listed in the CISA KEV catalog. The attack vector requires a legitimate WordPress login with at least Subscriber role, meaning that an attacker would first need access to a user account or must compromise authentication. Once authenticated, the attacker can invoke the vulnerable function to target arbitrary internal or external URLs, potentially causing information disclosure or modification.