The vulnerability in the Seriously Simple Podcasting plugin allows an attacker to direct the server to make arbitrary HTTP requests to internal or external resources, potentially leaking sensitive data or triggering unintended actions. It originates from an improperly validated input that the plugin uses to fetch podcast media or metadata. The weakness is classified as CWE‑918.

The flaw is present in all versions of the Seriously Simple Podcasting plugin up to and including version 3.14.1, distributed by Craig Hewitt for WordPress. Sites running any of these vulnerable versions are at risk until patched.

The CVSS score of 4.6 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the attack path requires the attacker to supply a crafted URL or media reference to the plugin, which is then forwarded by the server. Because the flaw allows outbound network traffic, a successful exploit could expose internal network resources or communicate with malicious endpoints.