The GetContentFromURL WordPress plugin contains an SSRF flaw that arises from using wp_remote_get() instead of wp_safe_remote_get() when processing the 'url' attribute of the [gcfu] shortcode. An attacker who is authenticated with Contributor or higher privileges can supply any URL and force the web application to initiate outbound HTTP requests. This enables the attacker to query internal services, retrieve sensitive data, or potentially modify internal state from within the server environment. The weakness is a classic input validation/authorization flaw (CWE-918).

WordPress sites running the GetContentFromURL plugin up to and including version 1.0, developed by daschmi, are affected. Any user with Contributor-level access or higher can exploit the vulnerability. No other WordPress plugins or core components are listed as affected.

The CVSS score of 7.2 classifies the vulnerability as high, reflecting the combination of moderate authentication (Contributor+) and the serious impact of SSRF. The EPSS score of less than 1% suggests that exploitation is currently uncommonly observed, but the risk remains due to the sensitive nature of internal requests. The issue is not listed in CISA KEV, indicating it has not yet been reported as a widely exploited vulnerability. Based on the description, the likely attack vector is a legitimate authenticated user who inserts a malicious URL into the shortcode, allowing the server to reach arbitrary endpoints, including internal network services.