The vulnerability in the Easy Replace Image plugin allows an attacker to cause the server to make arbitrary HTTP requests on its behalf. If leveraged, the server could reach internal network resources, access restricted data, or perform further attacks against downstream services. The plugin permits this through insufficient validation of user‑supplied URLs when replacing images. The weakness is classified as CWE‑918 and carries a CVSS score of 4.9, indicating moderate severity.

WordPress installations that have the Easy Replace Image plugin provided by Iulia Cazan, version 3.5.0 or earlier, are affected. The vulnerability applies to all releases from the plugin’s inception up to and including 3.5.0.

With a CVSS of 4.9 the risk level is moderate, yet the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to trigger plugin functions, typically by interacting with a WordPress admin interface or by forcing the plugin to process a crafted image URL. Because the attack requires server‑side request handling, the impact is limited to the privileged WordPress host, but can be used to probe internal networks or exfiltrate data.