A Server Side Request Forgery (SSRF) flaw exists in the SkatDesign Ratatouille WordPress theme through version 1.2.6. The vulnerability permits a malicious actor to cause the theme to initiate HTTP requests on behalf of the server, potentially accessing internal network resources or sensitive data. This weakness can expose confidential information or serve as a stepping‑stone for further exploits against internal services, depending on the configuration of the target environment.

The vulnerability affects the WordPress Ratatouille theme from the earliest released builds up to and including version 1.2.6. All installations using SkatDesign Ratatouille theme on WordPress platforms that have not upgraded past 1.2.6 are potentially exposed.

The CVSS score is 6.4, indicating a medium severity. The EPSS score is lower than 1%, suggesting that exploitation is unlikely to be widespread, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a crafted request to a WordPress page that triggers the theme’s request handler, which then issues back‑end traffic. Exploitation does not appear to require privileged access, but the attacker must be able to deliver a request to the vulnerable site. The lack of a publicly posted exploit and the low EPSS render the risk moderate, though mitigating the issue remains advisable for environments that expose sensitive internal networks.