The Podcast Player WordPress plugin, versions before 8.3.1, constructs an HTTP request to a target URL based on user input without validating that target. An attacker can therefore instruct the server to fetch data from any internal or external host. The fetched data is then parsed by the plugin as RSS or XML and returned to the attacker. The flaw provides the attacker with the ability to read arbitrary resources from the network on behalf of the web server, which can expose sensitive data or enable the server to be used as a proxy for other attacks, such as accessing protected internal services or exfiltrating information. The description does not indicate that a remote host can return dynamically executable code, so the primary risk is information disclosure and potential covert use of the server as an intermediary.

The affected product is the Podcast Player WordPress plugin. All installed copies running versions older than 8.3.1 are vulnerable; no additional sub‑version details are given in the advisory. WordPress installations hosting this plugin are therefore at risk if they have not yet upgraded to the release that includes the fix.

The CVSS score is not listed and the EPSS score is unavailable, but SSRF vulnerabilities are classed as high impact by many security frameworks because they allow unauthenticated redirection of the victim system to arbitrary endpoints. The lack of a KEV listing indicates no confirmed widespread exploitation reported to CISA at the time of this analysis; however, the potential for abuse remains significant for any publicly accessible WordPress site that uses a vulnerable version of the plugin. Attackers can target the flaw from the open internet without authentication, so the exploitability is high. The absence of concrete evidence of ongoing attacks does not diminish the theoretical risk.