SuitePlugins Video & Photo Gallery for Ultimate Member contains an SSRF flaw (CWE‑918). The plugin allows an attacker to supply arbitrary URLs that the server will request, potentially reaching internal or protected resources and leaking sensitive data. The vulnerability does not provide direct code execution but may facilitate data exfiltration or enumeration of the internal network. Based on the description, it is inferred that the attacker could trigger the flaw by submitting a crafted URL through the plugin’s administration interface or input fields.

All installations of the WordPress plugin Video & Photo Gallery for Ultimate Member with versions up to and including 1.1.2 are affected. No other versions or other products are listed as vulnerable.

The CVSS score of 4.9 rates the issue as moderate; the EPSS score is under 1%, indicating a low likelihood that the vulnerability will be actively exploited. The vulnerability is not listed in CISA KEV, suggesting no known broad exploitation. Attackers could trigger the flaw by submitting a crafted URL via the plugin’s administration interface or input fields, though no elevated privileges are required beyond normal user capability for the plugin. The likelihood is inferred from the description, as no direct exploitation details are provided.