The Contest Gallery WordPress plugin contains a Server‑Side Request Forgery flaw that allows an attacker to make the plugin issue HTTP requests to arbitrary URLs. This weakness can enable the attacker to reach internal systems or services that should not be exposed to the public, potentially disclosing confidential data or facilitating further attacks. Based on the description, it is inferred that the attacker could use the plugin as a proxy to access otherwise unreachable resources. The flaw is classified as CWE‑918.

The vulnerability affects the Contest Gallery plugin developed by Wasiliy Strecker. Any WordPress site running versions from the first public release through 28.1.2.1 is potentially impacted. No further sub‑version details are provided, so all releases up to and including 28.1.2.1 should be considered exposed.

The CVSS score of 6.4 indicates medium severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need the ability to trigger the plugin, likely through a specific endpoint, which may require authenticated access or could be exposed publicly; this is inferred from typical SSRF vectors. While the risk is moderate, any exposure to sensitive internal resources should be mitigated promptly.