The Content Syndication Toolkit plugin for WordPress contains a Server‑Side Request Forgery vulnerability that allows attackers to trigger any HTTP request from the web server. The vulnerable endpoint (wp_ajax_nopriv_redux_p) accepts a 'url' parameter from the query string, passes it directly to WordPress’s wp_remote_request() function without validation, and returns the response to the caller. Because no authentication, nonce, or URL whitelisting is enforced, an unauthenticated user can read the content of arbitrary internal or external resources, including cloud metadata endpoints or protected internal services. This can lead to information disclosure, internal network discovery, or potential further exploitation of downstream services.

This weakness exists in all releases of the Content Syndication Toolkit plugin for WordPress up to and including version 1.3, which is distributed by the vendor benmoody. Any WordPress site that has a vulnerable copy of this plugin installed is at risk.

The CVSS score of 7.2 reflects a moderate to high risk due to the lack of authentication and input validation. Exploitation requires only an unauthenticated HTTP request to the exposed AJAX endpoint; no special conditions are needed. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Consequently, the likelihood of exploitation remains moderate to high in environments where the plugin is active and exposed to the internet.