The Animate plugin for WordPress contains an SSRF flaw (CWE‑918) that allows the plugin to send requests to arbitrary URLs on behalf of the server. The flaw permits an attacker to trigger these requests without requiring additional privileges beyond the ability to interact with the vulnerable plugin.

WordPress installations that have the Adam Pery Animate plugin version 0.5 or earlier are affected. No specific WordPress core versions are cited, and only the presence of the vulnerable plugin is required for the flaw to exist.

The CVSS score of 4.9 indicates a moderate severity rating. The EPSS score of less than 1 % points to a low likelihood of exploitation. The vulnerability is not included in CISA’s KEV catalogue, reducing the urgency for immediate action. The CVE data does not specify the exact attack vector or conditions beyond the plugin’s request functionality; it is inferred that exploitation would require input of a target URL through that functionality.