The Quttera Web Malware Scanner plugin for WordPress contains a Server‑Side Request Forgery flaw. The RunExternalScan functionality allows an authenticated user with Administrator privileges to instruct the web application to send HTTP requests to arbitrary URLs. An attacker can leverage this to probe internal network services or modify data accessed by the plugin, potentially exposing sensitive information or enabling further compromise.

The vulnerability affects the Quttera ThreatSign – Web Malware Scanner for WordPress plugin in all releases up to and including version 3.5.1.41. Systems running any older version of WordPress that have this plugin installed with administrator access are impacted.

The CVSS score of 3.8 indicates low severity, and the EPSS score of less than 1 % shows a very low likelihood of exploitation at present. The issue is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited. Exploitability requires a valid administrator account and access to the plugin's external scan feature; once authenticated, an attacker can initiate internal requests and potentially gather or manipulate data from protected services.