The Getty Images WordPress plugin contains an SSRF flaw that allows an attacker to supply a custom URL that the server will resolve and fetch without proper validation. This weakness can lead to unauthorized disclosure of data, internal network reconnaissance, or interaction with internal services, depending on the target URLs accessed. The vulnerability is identified as CWE‑918 and is documented as existing in all releases up to and including version 4.1.0.

WordPress installations that use the Getty Images plugin version 4.1.0 or earlier are affected. Any site that has not upgraded beyond 4.1.0 (or migrated to a newer plugin version) remains vulnerable.

The CVSS score of 6.4 indicates a moderate severity, and an EPSS score of less than 1% suggests the likelihood of exploitation is low at present. The vulnerability does not appear in CISA’s KEV catalog. Attackers could exploit the flaw via a web request to the plugin’s endpoint, potentially forcing the server to contact arbitrary internal or external resources. No public exploit code is documented, but the path to exploitation is straightforward and only requires web access to the vulnerable plugin endpoint.