The vulnerability allows an attacker to exploit a server-side request forgery flaw in the WordPress Frontis Blocks plugin. Through crafted input, the plugin may initiate outbound HTTP requests to arbitrary URLs, potentially exposing internal network resources, enabling data exfiltration, or facilitating indirect attacks against other services. The primary weakness identified is CWE‑918. The impact is limited to the ability to force the server to fetch malicious or sensitive content but does not directly grant code execution or full system compromise.

WP Messiah products, specifically Frontis Blocks plugin version 1.1.5 or earlier are vulnerable. Systems running any WordPress installation with these plugin versions fall under the affected set. No other versions or related products are listed as impacted.

The CVSS score of 7.2 indicates a high severity. The EPSS score of less than 1% suggests a low relative probability of exploitation at this time, and the item is not listed in the CISA KEV catalog. The likely attack vector is remote exploitation through web requests to the vulnerable WordPress site. The description does not detail prerequisite conditions, so it is inferred that an unauthenticated or authenticated attacker with the ability to submit plugin configuration input could exploit the flaw. Given the low EPSS, immediate risk is moderate but still warrants remediation to prevent potential internal network exposure.