The DK PDF – WordPress PDF Generator plugin contains a server‑side request forgery flaw in its addContentToMpdf function. An authenticated user with author privileges or higher can supply arbitrary URLs, causing the plugin to issue web requests from the application server. This can allow the attacker to interrogate or modify data on internal services, potentially exposing sensitive configuration, credentials, or enabling further internal attacks. The weakness is classed as CWE‑918.

The vulnerability affects the DK PDF – WordPress PDF Generator plugin distributed by torstenbulk for WordPress. All releases up to and including version 2.3.0 are impacted; newer versions beyond 2.3.0 are not listed as affected.

The CVSS score of 5 indicates a moderate severity. The EPSS score of less than 1% signals a very low probability of exploitation at the time of analysis, and the flaw is not currently listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated with author-level access or higher and to submit a request that triggers the vulnerable function. The potential impact is primarily internal network compromise rather than direct code execution on the server.