The WP Scraper WordPress plugin contains a Server‑Side Request Forgery vulnerability in the wp_scraper_extract_content function. When exploited, an authenticated user with Administrator or higher privileges can instruct the web application to send HTTP requests to arbitrary URLs from within the server’s network. This capability can be leveraged to read sensitive data, alter configuration on internal services, or retrieve metadata on cloud platforms, thereby exposing or manipulating confidential information.

All installations of the WP Scraper plugin for WordPress up to and including version 5.8.1. The plugin, developed by rico‑macchi, is deployed within the WordPress content management system and is commonly used to scrape content from external sites.

The CVSS score of 6.8 classifies the weakness as moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires that the attacker already has Administrator‑level access, so the attack vector is secondary to credential compromise. Nevertheless, once authenticated, an attacker can make arbitrary outbound requests, creating a potential path for internal data exfiltration or manipulation of internal services.