The vulnerability in the ShawonPro SocialMark plugin allows an attacker to trigger a Server Side Request Forgery (SSRF). An unauthorized user could supply a crafted URL to the plugin, causing the WordPress server to make outbound HTTP(S) requests to arbitrary destinations. This could expose internal network resources or exfiltrate data, as the server executes the request with its own network privileges. The weakness is identified as CWE-918.

The affected product is the ShawonPro SocialMark WordPress plugin. All released versions up to and including 2.0.7 are impacted. Users running any version 2.0.7 or older must assess whether the plugin is in use on their sites.

The CVSS score is 4.9 and the EPSS score is less than 1%, indicating a low overall severity and a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the plugin’s exposed web interface, where a remote attacker can submit a malicious URL. Even with the low likelihood, any attacker who successfully triggers SSRF could force the server to access internal resources or traffic in defiance of normal security controls. Therefore, applying a patch or otherwise disabling the vulnerable functionality remains the most prudent response.