A Server Side Request Forgery flaw exists in the Alobaidi Extend Link WordPress plugin. The vulnerability allows an attacker to cause the web server to send arbitrary HTTP requests to internal or external addresses that the attacker specifies. The attacker can potentially extract sensitive data, compromise internal services, or use the server as a proxy or launch further attacks. This issue is classified as CWE‑918.

The affected product is the WordPress Extend Link plugin from the Alobaidi vendor. Versions up to and including 2.0.0 are impacted; newer releases are presumed to have the fix.

The CVSS base score of 4.9 indicates moderate severity. The EPSS score is under 1%, suggesting a very low likelihood of exploitation at the present time, and the vulnerability is not listed in the CISA KEV catalog. While the attack vector is not fully documented in the report, it is inferred that the flaw is triggered by supplying a malicious URL or remote resource reference through the plugin’s input mechanisms, likely requiring authenticated access to the WordPress administrative interface. If exploited, the attacker could read internal data or pivot to other systems via the web server.