Server Side Request Forgery discovered in minnur External Media plugin for WordPress allows an attacker to trick the server into making HTTP requests to arbitrary URLs. The flaw is found in plugin versions up to 1.0.36, and it can cause attackers to access internal services, exfiltrate data, or perform actions on behalf of the server. The underlying weakness is a lack of proper input validation for remote URLs, categorized as CWE‑918.

WordPress sites running the External Media plugin from any installation of minnur up to and including version 1.0.36 are impacted. No specific WordPress core version restrictions are indicated, so all WordPress installations with the affected plugin are potentially vulnerable.

The CVSS v3.1 score of 4.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV database, meaning no active exploit has been reported. Nevertheless, the attack could be executed remotely through the plugin’s interface, so site administrators should treat it as a legitimate risk, especially if the plugin is used in production environments with access to sensitive internal networks.