This vulnerability allows an attacker to trigger arbitrary outbound HTTP requests from the WordPress hosting environment through the Waymark plugin. Because the plugin does not validate or constrain the target URL, an attacker could obtain sensitive internal data, discover network topology, or abuse internal services. The CVSS score of 4.9 reflects that the impact is mainly confidentiality and integrity of data accessed via internal resources rather than denial of service or remote code execution.

WordPress installations that use the Joe Waymark plugin, versions up to and including 1.5.2. The plugin version 1.5.2 and earlier are affected; newer releases are not listed as vulnerable.

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of exploitation at the current time. Nevertheless, the attack vector is web‑based; an unauthenticated external user could construct a request that causes the plugin to resolve a malicious or internal URL. Because the flaw can be triggered via normal plugin functionality, there is no prerequisite of special access beyond accessing the plugin’s HTTP endpoints. The risk remains moderate due to the potential to access internal services, but the limited exploitation probability reduces overall urgency.