The BeerXML Shortcode plugin for WordPress contains a Server‑Side Request Forgery flaw that permits an attacker to instruct the server to perform arbitrary HTTP requests. The vulnerability is triggered when user input is forwarded to an internal request function without adequate validation, making it possible to reach internal or external resources the server can access. Exploitation could expose confidential data or facilitate further attacks such as remote code execution on downstream services. This weakness is classified under CWE‑918.

All releases of the BeerXML Shortcode plugin from the initial version up through 0.7.1 are affected. Sites that have installed or enabled the plugin and have not upgraded beyond 0.7.1 are vulnerable.

The CVSS v3 base score is 6.4, reflecting moderate severity. The EPSS score indicates less than 1% probability of exploitation, suggesting that the vulnerability is currently rarely targeted. The issue is not present in the CISA KEV catalog. An attacker can exploit the flaw remotely via a specially crafted request to the plugin’s endpoint; no special credentials are required if the endpoint is publicly accessible. Despite the low exploitation likelihood, the potential impact on confidentiality and integrity warrants a timely fix.