The vulnerability is a Server Side Request Forgery (SSRF) flaw in the ThemeREX Addons WordPress plugin. An attacker can provoke the server to request arbitrary URLs on the network, which may lead to internal network enumeration, data exfiltration, or the execution of code on the server. The flaw is a classic misuse of external‑resource fetching logic, mapping to CWE‑918.

ThemeREX Group ThemeREX Addons plugin for WordPress installations, affecting all releases up to and including 2.46.0. The fix is available in version 2.47.0 and later.

The CVSS score of 6.4 indicates medium severity. No EPSS score is published and the vulnerability is not listed in CISA’s KEV catalog. The flaw can be triggered by sending forged requests to the plugin’s exposed endpoints. The description does not specify authentication requirements; consequently, whether the risk applies to authenticated or unauthenticated users is uncertain and is inferred from the lack of explicit details. The lack of publicly available exploitation evidence suggests the attack vector is likely restricted to plugin‑level input rather than a direct public API.