An unauthenticated attacker can craft an AWS SNS SubscriptionConfirmation message and send it to Plunk’s /webhooks/sns endpoint. The handler accepts the message without validating the target URL and initiates an outbound HTTP GET to the supplied URL. This Server‑Side Request Forgery (CWE‑918) permits the attacker to cause the Plunk server to reach any host reachable from its network, exposing internal resources, leaking data, or exhausting system resources.

Deployment environments running any version of the open‑source email platform Plunk (useplunk:plunk) prior to version 0.7.0 are affected. The specific affected version range is not enumerated beyond the indication that all releases before 0.7.0 contain the flaw. Versions 0.7.0 and later incorporate the fix, as stated in the vendor advisory.

The vulnerability has a CVSS score of 9.3, indicating critical severity. The EPSS score is under 1%, implying limited exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is an unauthenticated HTTP POST to the exposed /webhooks/sns endpoint; no authentication or privileged access is required. Exposed deployments can be exploited from any internet‑reachable location, making the risk high for publicly accessible instances.