The vulnerability is a Server‑Side Request Forgery flaw that allows an external attacker to force the Simplified plugin to send arbitrary HTTP requests on the server’s behalf. An attacker could retrieve sensitive data from internal services, interact with administrative endpoints, or uncover network topology, all without direct access to the WordPress host. The weakness is identified as CWE‑918 and is limited to the plugin’s request logic.

WordPress plugin Simplified, version 1.0.11 or earlier, provided by kodeshpa. Any installation of the plugin on a WordPress site using these versions is affected.

The CVSS score of 5.5 reflects a moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is unauthenticated remote exploitation, where a malicious request includes a specially crafted URL to provoke the SSRF. If the site is exposed to the Internet, attackers can potentially map internal networks or pull confidential data by requesting internal resources.