This vulnerability is a Server‑Side Request Forgery (SSRF) that is triggered within the Kerge WordPress theme. An attacker can cause the theme to perform outbound HTTP requests to arbitrary URLs from the server, potentially exposing internal networks or data to external parties. The flaw is classified as CWE‑918 and could lead to unauthorized data disclosure, internal network probing, or other downstream compromise.

Affected systems include sites using the LMPixels Kerge theme version 4.1.3 or earlier. The vulnerability description lists all releases up to and including 4.1.3 as impacted, so any installation running one of those versions should be regarded as at risk.

The CVSS score of 5.4 indicates a moderate severity, and the EPSS score of less than 1% suggests the vulnerability is unlikely to be widely exploited at the present moment. The vulnerability is not included in CISA's KEV catalog. Exploitation would likely require an attacker to interact with a component of the theme that parses external URLs or triggers network calls, making the attack vector tied to user input or configuration that enables external resource fetching.