An SSRF flaw in the bdthemes ZoloBlocks WordPress plugin enables an attacker to coerce the server into making arbitrary HTTP requests. The vulnerability allows the construction of request URLs that can target internal resources, potentially enabling sensitive data discovery, lateral movement, or the exploitation of other services exposed only to the local network. The provided description does not specify an authentication requirement, so this flaw may be exploitable by any user who can trigger the plugin’s network‑related logic.

The affected product is the WordPress plugin ZoloBlocks from bdthemes. Versions from the earliest available through 2.3.11 are impacted. No patch is currently listed for newer releases; administrators should verify whether an updated version exists beyond 2.3.11.

The CVSS score of 5.4 indicates a medium‑to‑high severity, while the EPSS score of <1% suggests that active exploitation is unlikely at present. The flaw is not in CISA’s KEV catalog. An attacker could leverage the SSRF via the plugin’s network functions, sending requests to arbitrary URLs, which could map internal network structure or access restricted services. This attack vector is network‑based, requiring the ability to trigger the plugin logic from a web request.