The SeedProd Coming Soon Page, Under Construction & Maintenance Mode plugin contains an unvalidated mechanism that allows the server to perform arbitrary HTTP requests to any specified URL, a classic Server‑Side Request Forgery (SSRF) condition. Attackers can exploit this to reach internal resources, disclose sensitive data, or pivot to further attacks, and the weakness corresponds to the common issue described by CWE‑918.

WordPress installations that use SeedProd plugin version 6.19.8 or earlier are affected. The vulnerable range includes all releases up to and including 6.19.8, regardless of the release date, meaning any site running these versions is at risk unless upgraded.

The vulnerability has a CVSS score of 5.5, indicating moderate severity, while an EPSS score below 1% suggests a low probability of exploitation in real‑world scenarios. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the most likely attack vector involves an attacker crafting a URL and inserting it into the plugin’s maintenance mode settings, which the server then requests, potentially exposing internal data or enabling further compromise.