This vulnerability allows an attacker to trick the server into connecting to arbitrary URLs requested via the WP Compress for MainWP plugin. The resultant SSRF could expose internal services, retrieve sensitive data, or perform malicious traffic from the server, potentially impacting confidentiality and network reachability.

WP Compress for MainWP plugin versions up to and including 6.30.03 are affected; earlier releases are also vulnerable as the issue is noted to apply from n/a through <= 6.30.03.

The CVSS score of 4.9 indicates a moderate risk level. The EPSS score of less than 1% signals a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to exploit through the plugin’s input handling, which requires access to the WordPress site’s backend or some other form of authenticated interaction with the plugin’s processing logic.