The Chartbeat WordPress plugin up to version 2.0.7 contains a server‑side request forgery vulnerability that allows an attacker to instruct the server to fetch arbitrary URLs. Based on the description, it is inferred that the plugin does not perform verification of the target URL, which could enable the attacker to reach internal network services or obtain sensitive data that the server can access. This may lead to information disclosure and potential exploitation of internal resources.

WordPress sites that have the Chartbeat plugin installed from any version through 2.0.7 are affected. The vulnerability is present for all releases of the Chartbeat product in this range.

The CVSS score of 6.4 indicates medium severity, but the EPSS score of less than 1% suggests that exploitation attempts are unlikely at present. The vulnerability is not listed in the CISA KEV catalog, further indicating limited or no widespread exploitation. Attackers would need access to the site’s administrative interface or ability to trigger the plugin’s request mechanism, implying a remote or web‑based attack vector; this inference is drawn from the description.