The vulnerability is a Server‑Side Request Forgery (CWE‑918) that allows an attacker to force the WordPress site to send HTTP requests to arbitrary URLs through the WP Bannerize Pro plugin. This could expose internal resources, exfiltrate sensitive data, or enable further attacks if downstream systems are vulnerable. The CVSS score of 4.4 signals a moderate impact, as the flaw does not give direct access but permits malicious outbound traffic.

The flaw affects the WP Bannerize Pro plugin released by gfazioli and applies to all installations using version 1.10.0 or earlier. Any WordPress site that has not upgraded beyond this release is potentially vulnerable.

The EPSS score of less than 1% indicates that exploitation is unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the plugin’s banner management interface or automatically triggered banner requests, though the CVE description does not specify the exact trigger. Consequently, while the risk is moderate, the probability of a successful attack remains low unless the site is otherwise exposed to the public.