The vulnerability is a Server Side Request Forgery (SSRF) that allows an attacker to trigger the WordPress server to make HTTP requests to arbitrary URLs. By exploiting this flaw, a malicious user can potentially gain access to internal resources, exfiltrate data, or use the server to conduct further attacks. The weakness is classified as CWE-918, indicating improper validation of user supplied URLs.

The affected product is the ANAC XML Viewer plugin for WordPress, authored by Marco Milesi. All versions up to and including 1.8.2 are vulnerable. No additional version or scalability details are listed.

The CVSS score of 4.9 places this vulnerability in the moderate severity range. An EPSS score of less than 1% indicates a very low probability of exploitation at the current time, and the vulnerability is not present in the CISA KEV catalog. Attackers would likely target the plugin via the web interface that accepts external URLs; no additional conditions or external dependencies are required beyond the ability to supply a URL.