The Kargo Takip WordPress plugin allows unauthenticated users to supply an arbitrary URL in the 'api_url' parameter. The plugin passes this value to a server‑side request function, fetches the response from the target, and echoes back the content of the 'auth' field from the JSON payload. This behavior creates an SSRF flaw that can be used to probe internal services, read sensitive data from local metadata endpoints, and potentially modify internal resources depending on the target service’s API. The impact includes confidentiality disclosure of internal state and possible integrity damage, as the attacker can influence internal services via the forged requests.

WordPress installations running the Kargo Takip plugin version 1.2 or lower. Any site that has the plugin enabled is vulnerable regardless of user role, because the request path is publicly accessible.

The CVSS score of 7.2 indicates moderate‑to‑high severity; however, no EPSS score is available, so current exploitation likelihood is unknown. The vulnerability is not listed in CISA KEV, suggesting no confirmed exploit in the wild yet. Attackers can trigger the flaw by sending a crafted GET or POST request to the exposed endpoint containing an arbitrary 'api_url'. The plugin lacks authentication checks, so any visitor can exploit it. Full exploitation requires only network connectivity from the web server to the target internal service, which is typically present in shared hosting environments.