The Nexa Blocks plugin for WordPress contains a Server‑Side Request Forgery (SSRF) flaw in versions up to and including 1.1.1. An attacker can cause the site to make arbitrary HTTP or HTTPS requests to internal or external hosts and ports, potentially exposing sensitive data, bypassing firewall boundaries, or facilitating further attacks. The weakness is identified as CWE‑918.

Any WordPress installation that includes the Nexa Blocks plugin with a version number of 1.1.1 or earlier is affected. Site administrators using newer versions are not impacted.

The CVSS score of 4.9 denotes a moderate severity risk. An EPSS score of less than 1% indicates that exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an adversary sending a crafted request to a vulnerable endpoint exposed by the plugin; from there, the server could be coerced into contacting arbitrary resources. Defenses such as network segmentation, request validation, and limiting outbound connections reduce exploitability.