A server-side request forgery vulnerability in Wbcom Designs - Activity Link Preview For BuddyPress allows an attacker to trigger the WordPress server to make arbitrary HTTP, HTTPS, or NTLM requests. The flaw arises from insufficient validation of URLs supplied in activity preview requests and is classified as CWE‑918. Successful exploitation can lead the plugin to contact internal or external resources, potentially exposing sensitive data, accessing privileged endpoints, or exfiltrating information. The impact is limited to the server hosting WordPress and any services reachable from that environment; the vulnerability does not provide direct code execution but can facilitate data discovery or further attacks.

WordPress sites that have installed Varun Dubey Wbcom Designs – Activity Link Preview For BuddyPress version 1.4.4 or earlier. The plugin expresses the flaw across all supported WordPress versions. No specific WordPress core versions are excluded; any WordPress installation using this plugin is affected.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of less than 1% suggests a low predicted exploitation likelihood. Because the plugin does not require elevated privileges to trigger the SSRF, an unauthenticated attacker can exploit the flaw through crafted activity links, though the exact attack vector is inferred from the plugin’s functionality. The vulnerability is not listed in the CISA KEV catalog, meaning it has not been reported as known to be exploited in the wild at the time of this analysis.