An SSRF vulnerability exists in the Oxygen theme for WordPress versions up to 6.0.8 that allows an attacker to instruct the server to make arbitrary HTTP requests to external or internal resources. The flaw is rooted in list 918 and could enable an attacker to exfiltrate sensitive data, interact with internal services, or serve as a stepping stone for further exploitation.

The vulnerable product is Laborator's Oxygen theme for WordPress, affecting all releases from the earliest available version through version 6.0.8.

The CVSS score of 7.2 signifies a high severity while the EPSS score of less than 1% indicates a currently low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require a remote actor to supply a crafted URL to a feature in the theme that performs outbound requests, presenting a clear remote attack vector.