A Server‑Side Request Forgery vulnerability exists in SmartDataSoft DriCub theme versions up to 2.9. The flaw allows an attacker to instruct the server to make arbitrary HTTP requests. This could enable disclosure of internal network information, unauthorized access to services, or data exfiltration, depending on what the server can reach.

The vulnerability affects the DriCub WordPress theme produced by SmartDataSoft, specifically all releases through 2.9. Any website running this theme and its dependencies should be reviewed for version alignment.

The reported CVSS score of 5.4 signifies a moderate risk. EPSS value of < 1% suggests that observed exploitation likelihood is very low, and the vulnerability is not currently listed in the CISA KEV catalog. The SSRF can likely be triggered by sending crafted requests to the theme’s endpoint, potentially without authentication, though the exact prerequisites are not detailed; attackers could exploit it to reach internal resources or exfiltrate data if the server can resolve DNS lookup. The lack of a KEV listing reduces the pressure for immediate response but still warrants mitigation.