A flaw in the WP Optin Wheel plugin for WordPress permits a Server Side Request Forgery (SSRF); an attacker can instruct the application to send HTTP requests to arbitrary URLs, potentially accessing internal resources, leaking data, or interacting with services that are otherwise unreachable. The weakness is classified as CWE‑918 and allows an attacker to initiate outbound connectivity from the web server without validation.

The vulnerability applies to all versions of the Wombat Plugins WP Optin Wheel up to and including 1.4.7 installed on WordPress sites. Any site running one of these versions is potentially susceptible.

The CVSS score of 5.4 indicates a moderate risk level, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require submitting crafted data that the plugin processes as a URL, triggering the unintended server-side request. The impact could be data exposure or further chaining attacks against internal services reachable from the web server.