Server‑Side Request Forgery vulnerability in the Publitio plugin enables the plugin to issue HTTP requests to arbitrary URLs. This flaw could potentially expose internal resources or leak credentials, but no remote code execution is explicitly documented. The weakness is identified as CWE‑918.

This vulnerability applies to all installations of the Publitio plugin version 2.2.1 or earlier. WordPress sites using any of these releases are potentially exposed, regardless of the site’s custom configurations. The flaw originates from the plugin’s 'publitio' component.

The CVSS score of 6.4 points to a moderate to high risk, but the EPSS score of less than 1 % indicates a low probability of current exploitation. The advisory does not list the vulnerability in the CISA KEV catalogue. Exploitation requires remote access to the WordPress site’s admin interface or user‑generated content that triggers the SSRF endpoint. Based on the description, it is inferred that an attacker could supply a crafted URL parameter to force the plugin to reach internal services.