The vulnerability allows an attacker to force the WordPress server running Nelio Content to send arbitrary HTTP requests to any target reachable from the internal network. This Server‑Side Request Forgery (CWE‑918) could expose sensitive internal services or data, and in some cases be used to pivot to further attacks. The impact is a potential breach of confidentiality and, if the application or network resources suffer denial of service from excessive requests, an availability threat as well.

Nelio Software’s Nelio Content plugin is affected. All releases from the earliest version through 4.3.1 are vulnerable. No higher versions are mentioned as impacted.

The CVSS score of 4.9 places the issue in the moderate severity range, while the EPSS score of less than 1% indicates a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, so there is no confirmed exploitation activity recorded. Attackers would need to interact with the plugin’s exposed functionality, most likely through unauthenticated or low‑privilege web requests, to trigger the SSRF. No advanced exploit code is documented, but the basic SSRF path could be reused in multi‑stage attacks once the initial compromise is achieved.