The flaw is a server‑side request forgery (SSRF) in the Skimlinks Affiliate Marketing Tool WordPress plugin. An attacker can force the application to make arbitrary HTTP requests to internal or external resources, potentially exposing sensitive data or enabling further attacks. The weakness is classified as CWE‑918. The plugin version 1.3.1 and earlier are affected; the description does not list a specific patch or remediation detail.

WordPress installations running the Skimlinks Affiliate Marketing Tool plugin version 1.3.1 or older are vulnerable. The plugin is listed under the vendor Skimlinks as the Skimlinks Affiliate Marketing Tool product. No additional versions are specified, so any unauthenticated or authenticated use of the plugin in that range is at risk.

The CVSS score of 4.4 indicates moderate severity. The EPSS score is below 1 %, suggesting a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve remote exploitation by inducing the application to request arbitrary URLs, but no public exploit details are provided in the CVE records.