The vulnerability is a Server Side Request Forgery that permits remote code callers to instruct the WordPress instance to fetch arbitrary URLs. This weakness (CWE-918) can lead to internal network disclosure or the execution of unintended actions on third‑party services, potentially compromising confidentiality or allowing further lateral movement, but it does not directly provide arbitrary code execution on the server host.

The issue affects the Solace Extra plugin for WordPress, version 1.3.1 and earlier.

The CVSS score of 4.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack likely requires the ability to supply a target URL to the plugin’s request endpoint; the exact attack vector is inferred, not explicitly stated in the available data.