The Allmart WordPress plugin contains a Server Side Request Forgery flaw that lets an attacker supply arbitrary URLs to be fetched by the server. By exploiting this, a malicious party can force the web application to request any external or internal resource, potentially revealing sensitive data or facilitating covert data exfiltration. The vulnerability is tied to CWE‑918 and can be used to bypass network boundaries when outbound restrictions are absent.

WordPress sites that have installed the TeconceTheme Allmart Allmart‑Core plugin at any version up to and including 1.0.0 are affected. The issue applies to all releases from the earliest available build through 1.0.0, so site administrators should check the installed version and upgrade if a patched release is available.

The CVSS score of 7.2 classifies this issue as high severity. EPSS is below 1 % indicating a low historical exploitation probability, and the vulnerability is not listed in CISA KEV. However, the attack can be launched remotely via the plugin’s request endpoint, and once triggered the server may retrieve internal or external resources, exposing sensitive data or providing a foothold into the internal network.