The vulnerability in the extendons WordPress & WooCommerce Scraper Plugin, Import Data from Any Site allows an attacker to force the server to make arbitrary outbound HTTP requests. This Server Side Request Forgery (SSRF) flaw can be exploited to contact internal network services, bypass firewall restrictions, or exfiltrate sensitive data, potentially compromising confidentiality and integrity of the system. The weakness is categorized as CWE-918.

All installations of the extendons WordPress & WooCommerce Scraper Plugin, Import Data from Any Site with version 1.0.7 or earlier are affected. This includes any WordPress site that has deployed the plugin without updating beyond that version.

The CVSS score of 5.4 indicates a moderate level of severity, and the EPSS score of less than 1% suggests that exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, where an attacker supplies a crafted URL to the plugin’s import function, causing the host to request that URL and thereby gain the ability to reach internal resources or other external sites. With the lack of current exploit evidence and low exploitation probability, the risk remains moderated but still warrants attention.