Builderius.io Builderius plugin for WordPress contains a server‑side request forgery vulnerability that allows an attacker to force the plugin to make arbitrary HTTP requests on behalf of the server. The flaw can expose internal network resources or external data to the attacker and could be leveraged as a foothold for further attacks if internal systems are reachable. The vulnerability is rated as high severity as indicated by the CVSS score.

The vulnerability affects Builderius plugin versions 1.4 and the dependent 1.4‑beta release for WordPress. These versions are listed as impacted by the CNA, with no other product or vendor identifiers indicated beyond the Builderius.io Builderius plugin.

With a CVSS score of 7.2, the risk is considered high. The EPSS score is not available, so the probability of exploitation is unclear, but the lack of KEV listing suggests no widely‑known exploitation currently. Attackers could exploit the flaw via the WordPress interface, likely without authentication. The impact is limited to the scope of the affected site but could provide entry to internal networks through crafted requests.