A server‑side request forgery (SSRF) flaw exists in Metagauss ProfileGrid plugin version 5.9.5.2 and earlier, allowing an attacker to instruct the WordPress site to make arbitrary HTTP requests to internal or external endpoints. This can lead to leakage of sensitive data, port scanning, or further exploitation of services that the site can reach, thereby compromising confidentiality and potentially availability of network resources.

The vulnerability affects the WordPress ProfileGrid plugin developed by Metagauss, specifically all releases from the initial version through 5.9.5.2. WordPress installations that have this plugin at or below that version are susceptible.

With a CVSS score of 4.9 the flaw is considered moderate in severity, but the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, further suggesting limited active exploitation reports. The likely attack vector is through the plugin’s functionality that accepts user‑supplied URLs, but the exact exploitation method was not detailed in the input.