The vulnerability is a server‑side request forgery that allows an attacker to force the plugin to make arbitrary HTTP requests from the host. A successful exploitation could enable sensitive data disclosure, further lateral movement, or the issuance of requests against internal infrastructure, depending on the server’s outbound configuration. The weakness is classified as CWE‑918, indicating that untrusted data is used to construct a request that is then sent by the server without proper validation.

This issue affects the WordPress plugin WP AVCL Automation Helper (formerly WPFlyLeads) authored by Ankur Vishwakarma. Versions from the initial release, indicated by "n/a", through v3.4 are vulnerable. No later versions are listed as affected.

The CVSS score of 4.9 places the risk in the moderate range, but the EPSS score of less than 1% indicates that real‑world exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog, which aligns with the low exploitation probability. The likely attack vector is internal, as the SSRF leverages the website’s ability to initiate outbound connections; external attackers gain access through exploitation of the plugin’s functionality within the WordPress installation.