The vulnerability resides in the backend database management connection test feature of wgcloud 3.6.3 and enables a classic SSRF flaw (CWE‑918). When exercised, the server will send requests to arbitrary URLs specified by the attacker. This can be used to discover internal services, transfer sensitive data out of the protected network, or download malicious payloads for later exploitation. The impact is therefore the inadvertent disclosure or manipulation of internal data and the potential for further compromise, with confidentiality and integrity risks for the organization’s internal resources.

The affected product is wgcloud version 3.6.3, distributed by the vendor wgstart. No other vendors or products are explicitly listed; the CPE string confirms a single product family. The flaw is limited to the database connection test functionality within this version.

The CVSS score of 7.5 denotes a high level of risk while the EPSS value of less than 1% suggests that current exploit attempts are rare. This vulnerability is not listed in the CISA KEV catalog, implying that widespread, publicly available exploits are not yet known. The likely attack vector requires exploitation of the API endpoint that initiates the connection test, possibly requiring authenticated access by an administrator or privileged user. Once accessed, the attacker can instruct the server to reach out to any internal or external address, exposing the network to reconnaissance and entry points for further attacks.