The vulnerability is a Server Side Request Forgery (SSRF) in the WordPress Photo Block plugin versions 1.7.1 or earlier. SSRF allows an attacker to cause the server to send HTTP or HTTPS requests to arbitrary destinations, potentially including internal IP ranges. (The possibility that an attacker could exploit the flaw to reach internal resources is inferred from the nature of SSRF, not explicitly stated in the CVE description.)

The flaw exists in the Photo Block plugin developed by Ronald Huereca. Any WordPress installation running Photo Block version 1.7.1 or older is affected.

The CVSS v3 score of 4.4 indicates low severity, while the EPSS score of less than 1% suggests a low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector would involve a publicly accessible HTTP request to a WordPress site that has the vulnerable plugin installed, which could trigger the server to make outbound requests to arbitrary URLs. (This attack path is inferred from typical SSRF behaviour.)