The MimeTypes Link Icons plugin for WordPress processes user‑controlled URLs when the "Show file size" setting is enabled, issuing outbound HTTP requests without proper validation. This flaw creates a Server‑Side Request Forgery vulnerability that allows authenticated users with Contributor level or higher to request arbitrary internal or external resources from the application’s host. The ability to craft links embedded in post content means an attacker could retrieve sensitive data or alter internal services, though direct code execution is not possible.

WordPress sites running the eagerterrier MimeTypes Link Icons plugin, in any version up to and including 3.2.20, are affected. The vulnerability applies regardless of the WordPress core version and requires only that a user with Contributor permissions or greater composes malicious post content.

The CVSS score of 8.3 indicates high severity; there is no EPSS score available and the issue is not listed in CISA’s KEV catalog. Exploitation requires authenticated access and the "Show file size" option to be enabled. An attacker can inject a crafted link that causes the server to request internal endpoints, potentially exfiltrating data or modifying services. The risk is therefore primarily dependent on the attacker’s privileged role and the sensitivity of the backend services accessed through SSRF.