The URL Preview plugin for WordPress contains a Server‑Side Request Forgery flaw that allows unauthenticated attackers to specify any URL through the 'url' parameter. An attacker can cause the web application to send requests to arbitrary external or internal addresses, potentially exposing sensitive data, modifying internal services, or enabling further lateral movement. The vulnerability directly exploits a flaw in input validation (CWE‑918) that fails to restrict the scope of outbound requests.

WordPress sites that have the URL Preview plugin installed, any version up to and including 1.0. The plugin is maintained by abhisheksaha11 and is exposed through its public interface.

The CVSS score of 7.2 categorizes the vulnerability as high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Because authentication is not required, an attacker can target the issue from any external source, increasing the likelihood of exploitation. The SSRF nature allows the attacker to reach internal services that normally would not be exposed, creating a significant attack surface.