A Server‑Side Request Forgery flaw exists in the ThimPress WP Pipes plugin. The vulnerability, classified as CWE‑918, allows an attacker to cause the vulnerable WordPress instance to issue arbitrary HTTP requests on the attacker's behalf. This can enable the attacker to reach internal network resources or contact external services, thereby compromising confidentiality and availability of internal assets. The plugin does not restrict or validate the target URLs, and the flaw can be triggered via standard web interfaces.

WordPress sites that use the ThimPress WP Pipes plugin up to and including version 1.4.2 are affected. Any site installing a vulnerable version of the plugin should treat its installation as susceptible to SSRF exploitation.

The CVSS score of 4.4 places the flaw in the moderate severity range, and the EPSS score of less than 1% indicates a low probability of widespread exploitation as of the latest data. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is through web requests to the plugin's interface, where unsanitized URLs are processed. Successful exploitation would allow unauthorized access to internal hosts or service endpoints that the WordPress server can reach.