The Content Mask plugin for WordPress contains a server‑side request forgery flaw that allows an attacker to direct the server to fetch arbitrary URLs. This privilege can disclose sensitive information or manipulate internal resources, leading to potential data theft or execution of further attacks. The weakness is classified as CWE-918, a classic SSRF issue that compromises confidentiality and integrity.

Any WordPress site installed with Alex Content Mask version 1.8.5.2 or earlier is affected. Administrators running WordPress need to check the plugin version and take action if it remains on a vulnerable release.

The CVSS v3.1 score of 6.4 marks it as a moderate severity vulnerability. The EPSS score of less than 1% suggests a very low probability of exploitation at present. The flaw is not listed in CISA KEV. Attackers would need to send a crafted request to the plugin’s endpoint that forwards the supplied URL to the server; because the vulnerability does not explicitly mention authentication requirements, the attack could be performed by anyone who can reach the endpoint, meaning it is likely an unauthenticated SSRF.