The Metform plugin contains a Server‑Side Request Forgery flaw that allows an attacker to force the WordPress host to request arbitrary URLs. By exploiting this flaw, an attacker could communicate with internal services, exfiltrate data, or use the infected host as a pivot to access other resources. The weakness is classified as CWE‑918.

Any WordPress site that has Roxnor Metform installed and runs a version up to and including 3.9.2 is affected. Versions newer than 3.9.2 are considered fixed.

The CVSS rating of 4.4 indicates moderate severity, while the EPSS score of <1% signals a low current exploitation probability and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a publicly accessible form that accepts a URL parameter; the plugin processes that URL without validation, allowing an attacker to force outbound requests to internal addresses or external services.