The vulnerability allows an unauthenticated attacker to supply an arbitrary URL to the 'url' parameter in the ''template_proxy'' function. By doing so, the plugin will send HTTP requests from the host server to any destination resolved from that URL, effectively enabling the attacker to piggyback on the web application to reach internal or external resources. This can expose confidential data, enable phishing or malware delivery, or be used for reconnaissance of internal services. The weakness is identified as CWE-918.

All installations of the Frontis Blocks WordPress plugin provided by wpmessiah, specifically versions 1.1.6 and earlier. These versions expose the '/template-proxy/' and '/proxy-image/' endpoints that process the vulnerable 'url' parameter without authentication checks.

The CVSS score of 7.2 indicates a high severity, while the EPSS score is below 1%, suggesting a low current exploitation probability but still significant due to the high impact. The vulnerability is not listed in CISA’s KEV catalog, but it remains exploitable via simple HTTP requests to the plugin’s endpoints, which require no credentials. Consequently, any WordPress site running an affected version of the plugin is at risk of SSRF without specific mitigation.