The vulnerability in the PhastPress WordPress plugin allows attackers to forge the HTTP Host header, which the scripts service endpoint uses to build a URL whitelist. By spoofing this header, an unauthenticated attacker can make the server send HTTP requests to any internal or external address and return the response content. This enables the attacker to read sensitive internal resources, exfiltrate data, or potentially interact with APIs that could lead to further compromise. The impact is a high‑severity SSRF that undermines confidentiality and can serve as a foothold for further attacks.

Affected versions are all releases of the PhastPress plugin up to and including 3.10. The plugin is distributed by Kiboit. No specific patch version is listed in the advisory, but any release newer than 3.10 is presumed to address the flaw.

With a CVSS score of 7.3, the vulnerability is considered high severity. The EPSS score is not available, so the exact likelihood of exploitation is unknown, yet the issue is unauthenticated and remote, meaning it could be abused by a wide range of external actors. The flaw is not listed in the CISA KEV catalog, but the potential impact warrants prompt action. An attacker can reach the server over the web, craft a request with a malicious Host header, and trigger the plugin to contact arbitrary destinations, gaining access to internal resources or external services. The risk is amplified if internal network services are exposed and can be reached through the vulnerable endpoint.