The MailerPress plugin contains a Server‑Side Request Forgery (SSRF) vulnerability that allows an attacker to trick the server into making arbitrary HTTP requests on the server's behalf. This can lead to the disclosure of sensitive internal resources, facilitate further network reconnaissance, and potentially enable more severe exploits depending on the server's configuration. The weakness is classified as CWE‑918.

The vulnerability affects the MailerPress plugin from its earliest available version through version 1.4.2, as published by the MailerPress Team.

The estimated CVSS score of 6.4 indicates a moderate severity. The EPSS score is below 1%, suggesting a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, exploitation would require the ability to trigger the plugin’s request mechanics, likely through an authenticated user with plugin configuration privileges or possibly unauthenticated if the plugin is exposed to public input. The attack vector is therefore local to the WordPress instance and does not appear to require external network access beyond the target server.