The flaw is a Server Side Request Forgery vulnerability identified as CWE‑918 in the Binsaifullah Beaf image‑compare‑block plugin. It permits an attacker to instruct the server to retrieve arbitrary resources over HTTP or HTTPS, potentially revealing internal data or accessing services in the host’s environment.

The affected product is the Binsaifullah Beaf WordPress plugin, specifically version 1.6.2 and all earlier releases. No particular operating system or platform restrictions are listed; the issue exists wherever the plugin is installed and operational.

The CVSS score of 4.4 indicates a low to moderate severity, and the EPSS score of less than 1 % suggests exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description and the nature of SSRF, the most probable attack vector involves an attacker sending a specially crafted request to the plugin’s interface or API, which then triggers the server to make outbound calls to arbitrary URLs. Successful exploitation would allow the attacker to probe internal or externally reachable resources through the server’s outbound connectivity.