The vulnerability lies in the fs_api_request function of the B Slider – Gutenberg Slider Block for WP plugin, permitting an authenticated attacker with subscriber-level or higher permissions to initiate HTTP requests from the server to arbitrary URLs. This Server‑Side Request Forgery enables the attacker to probe, read, or modify data on internal services that the web application can reach, thereby potentially exposing sensitive information or altering system state. The weakness is classified as CWE‑918, a typical SSRF vulnerability.

The plugin bSlider supplied by bplugins is affected for all versions of the plugin up to and including 2.0.0 installed on WordPress sites. Any installation where the plugin is active and the vulnerable fs_api_request endpoint is reachable is susceptible, regardless of other plugins or themes.

The CVSS base score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests that exploitation is currently unlikely, with no listings in the CISA KEV catalog. Exploitation requires the attacker to be authenticated with subscriber-level or higher access, so the attack vector is through authenticated HTTP traffic directed at the plugin’s API. An attacker who obtains such credentials can use the SSRF path to query internal endpoints, potentially leaking confidential data or disrupting internal services.