Server‑Side Request Forgery vulnerability in KaizenCoders URL Shortify plugin may allow an attacker to induce the plugin to make unauthorized HTTP requests to internal or external services, enabling data exfiltration, resource discovery, or further exploitation of vulnerable services. The weakness corresponds to CWE‑918, which tracks server‑side request forgery.

WordPress sites running KaizenCoders URL Shortify plugin version 1.12.3 or earlier are affected. No other product versions are listed as impacted.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score indicates a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker crafting a URL that the vulnerable plugin processes, causing the WordPress server to initiate requests to arbitrary destinations. No specific environmental prerequisites are indicated, so the exploit can be carried out through normal plugin usage.