The IMGspider plugin for WordPress contains a server‑side request forgery flaw that permits an attacker to cause the web server to issue requests to arbitrary URLs. The description notes this vulnerability, but does not detail the exact mechanisms or resulting impacts beyond the SSRF indicator. Based on typical SSRF behavior, the attacker could influence outbound traffic, though the specific consequences are not enumerated in the data.

The flaw affects the IMGspider plugin from wbolt.com, all releases from the earliest version through version 2.3.12. Any WordPress installation that has a vulnerable instance of this plugin is at risk.

The CVSS base score of 9.1 classifies this as a critical vulnerability. The EPSS score indicates the exploitation probability is below 1%. The CVE data does not mention public exploits, so it is unclear whether any exist, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector involves a remote actor sending a specially crafted request to the plugin's endpoint, which then performs an HTTP/HTTPS request to whatever URL the attacker controls. This inference comes from the typical nature of SSRF defects.