This vulnerability is a Server Side Request Forgery in the Codeless Slider Templates plugin for WordPress. An attacker that can trigger the plugin to send requests could force the affected WordPress server to reach arbitrary URLs. Depending on the internal network topology, the attacker might retrieve sensitive information or interact with internal services, enabling further compromise. The weakness corresponds to CWE-918.

The issue affects WordPress sites running the Slider Templates plugin from Codeless, versions up through and including 1.0.3. Any installation of those versions is potentially vulnerable; newer versions are not listed as affected.

The CVSS score of 4.9 reflects a low severity impact, and the EPSS value of less than 1% indicates a very low expected exploitation probability. The vulnerability is not included in the CISA KEV catalog. Exploitation would require an attacker to access the WordPress site and manipulate the plugin's request handling, which is generally accessible to authenticated administrators or through public entry points. The risk to confidentiality, integrity, or availability is limited unless the server can reach critical internal resources.