The vulnerable functionality is the url_media_uploader_url_upload action in the URL Media Uploader WordPress plugin. A flaw described by CWE‑918 allows authenticated users with author level or higher to instruct the web application to send HTTP requests to arbitrary domains. This can be used to probe internal network services, exfiltrate data, or potentially modify internal resources, without requiring elevated or unauthenticated access. The vulnerability does not provide direct code execution but enables attackers to interact with sensitive internal systems, creating a significant threat to confidentiality and integrity.

The issue affects the WordPress plugin URL Media Uploader from the vendor Apprhyme, for all releases up to and including version 1.0.0. Users should verify whether their installations are running any of these affected versions and plan for an upgrade as appropriate.

The CVSS score of 6.4 indicates medium severity. The EPSS score is below 1 %, suggesting that community exploitation is expected to be low. The vulnerability is not listed in the CISA KEV catalog. Attackers must possess author‑level or higher credentials and trigger the url_media_uploader_url_upload action. No public exploit has been reported, but the potential to access internal infrastructure makes the risk materialized if an attacker has the required permissions. Organizations should treat this as a moderate risk but prepare remediation promptly.