The vulnerability resides in the 'saveDataSource' function of the Fluent Forms Pro Add On Pack plugin for WordPress. It allows an attacker who is authenticated with at least Subscriber level to instruct the application to send HTTP requests to arbitrary destinations. The weakness can reveal or alter internal resources, thereby compromising confidentiality and integrity of internal services. The core weakness is identified as CWE‑918, a classic SSRF scenario.

WordPress sites running Fluent Forms Pro Add On Pack version 6.1.12 or earlier. The plugin is distributed by techjewel and can be present in a wide range of WordPress installations. Specific version numbers are limited to 6.1.12 and earlier according to the CVE data.

The CVSS score of 5.4 indicates moderate severity, but the EPSS score of less than 1% suggests it is not currently a high‑probability target. Because only authenticated users can exploit it, the threat is limited to sites with exposed subscriber accounts. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploits are recorded at this time. However, the fact that the attack requires legitimate credentials means that social engineering or credential compromise could enable exploitation. Attackers would likely use the SSRF to probe internal services, potentially pivoting to other systems if internal requests are permitted.