The flaw allows the Simple Google Photos Grid plugin to perform HTTP requests to arbitrary URLs. This Server Side Request Forgery can enable an attacker to probe internal or remote servers if the plugin's URL parameter is controllable. The vulnerability is classified as CWE‑918. The description does not specify exactly which assets could be accessed, but the nature of the flaw suggests potential for unauthorized data access or service disruption.

All releases of the Simple Google Photos Grid plugin developed by josheli up to and including version 1.5 are affected. WordPress sites that host or use this plugin are potentially exposed, regardless of the WordPress core version.

With a CVSS score of 4.9 the issue is moderate. The EPSS score of below 1% indicates a low probability of exploitation currently, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote execution, inferred from standard SSRF behavior: an attacker who can supply a URL to the plugin’s import function would trigger outbound HTTP requests from the server, possibly reaching internal services.