A Server-Side Request Forgery (SSRF) flaw exists in the TS Poll plugin for WordPress, enabling an attacker to force the application to make arbitrary HTTP requests to internal or external resources. If exploited, the plugin could fetch sensitive information, communicate with internal services, or facilitate further attacks such as remote code execution. The weakness stems from improper validation of user-supplied URLs, classified as CWE-918.

The vulnerability impacts the totalsoft TS Poll plugin for WordPress, affecting all releases up to and including version 2.5.5. Users running these versions on any WordPress installation are at risk.

The CVSS score of 4.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The flaw is not currently listed in CISA's KEV catalog. The attack vector is inferred to be via an exposed endpoint in the plugin that accepts URLs without proper sanitization, likely requiring authenticated or unauthenticated access to a poll-related activity. No patch is published in the data, so the risk remains until a version that removes the flaw or restricts outbound requests is deployed.