The vulnerability is a Server Side Request Forgery (SSRF) that allows an attacker to craft requests that the plugin forwards to arbitrary destinations. This flaw can lead to the exploitation of internal network resources, disclosure of sensitive data, or unauthorized access to systems behind the web server. The weakness is identified as CWE‑918, a type of input validation flaw that permits uncontrolled external requests.

The WordPress plugin Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One is affected in all versions from the initial release through 2.3.3. The vendor identified for this product is aitool. Users of any version up to and including 2.3.3 must review their deployments.

The CVSS score of 4.9 indicates a moderate severity. The EPSS score is below 1%, implying a low probability of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would most likely occur through the plugin’s ability to fetch external URLs, which may require authenticated access or just a user of the site to trigger the call, but the exact prerequisites are not detailed in the advisory. Consequently, the risk remains present for currently vulnerable installations, especially if the plugin is exposed to untrusted input.