A server‑side request forgery (SSRF) flaw in the princeahmed Radio Player WordPress plugin permits a remote attacker to initiate HTTP or other protocol requests from the vulnerable server. This can expose internal network endpoints, allow arbitrary data exfiltration, or serve as a pivot for further attack steps. The weakness is identified as CWE‑918.

The vulnerability exists in the Radio Player plugin for WordPress from the initial release through version 2.0.91, delivered by the vendor princeahmed. Any WordPress site installing or running that plugin within this version range is affected.

The CVSS v3.1 score is 5.3, indicating a medium impact. The EPSS score is below 1%, suggesting a low likelihood of widespread exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers would need to supply a crafted request through the plugin’s functionality to trigger outbound traffic to a target resource; because the flaw does not grant code execution, the attack surface is limited to network access via the vulnerable server.