The vulnerability is a Server‑Side Request Forgery that can be triggered through the fip_get_image_options() function in the Featured Image Plus plugin. An attacker who has administrator or higher privileges on a WordPress site can use this flaw to make web requests to arbitrary locations from the server, potentially exposing internal network services or sensitive data. The flaw does not directly compromise the server itself, but it enables the attacker to read or modify information from other systems reachable from the WordPress host, which can lead to data exfiltration or manipulation of internal services.

WordPress sites that use the Featured Image Plus – Bulk Edit Featured Images, Unsplash & Alt Text Manager plugin version 1.6.6 or earlier. The plugin is maintained by krasenslavov. All site administrators with access to the plugin’s bulk edit features are potentially affected.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of less than 1% suggests low exploitation probability so far. The flaw is not listed in CISA’s KEV catalog. Given that the vulnerability requires authenticated admin privilege, an attacker would need to compromise a site administrator account or exploit an existing admin login. Once an attacker obtains that access, they can trigger the SSRF via the bulk edit route and cause the server to perform arbitrary HTTP requests. No public exploit binaries are available, but the path could be reproduced by a site administrator or a malicious plugin author.