PressForward plugins up to version 5.9.5 contain a server‑side request forgery flaw that allows an attacker to cause the plugin to send arbitrary HTTP or HTTPS requests to internal or external addresses. This weakness arises from the plugin accepting URLs from user input without sufficient validation, resulting in an integrity breach of the WordPress site and potential exposure of sensitive data. The underlying weakness is CWE‑918, which denotes SSRF vulnerabilities.

WordPress sites that have the PressForward plugin installed in any version from the earliest available release through 5.9.5 are impacted. The vulnerability is present in all releases of the plugin up to and including 5.9.5; all WordPress installations that rely on any of those versions are therefore at risk.

The CVSS score of 6.4 indicates a medium severity impact, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, which further reduces the likelihood of widespread exploitation. The likely attack vector is inferred to be an authenticated user with access to the PressForward interface or an unauthenticated user if the plugin exposes any public endpoints; the issue stems from unsanitized URL handling within the plugin code.