Server‑Side Request Forgery (SSRF) allows an attacker to instruct the vulnerable Global Payments WooCommerce plugin to issue HTTP requests to arbitrary URLs, potentially accessing internal services or external sites without proper authorization, which could lead to data exposure or further exploitation. This weakness, classified as CWE‑918, originates from insufficient validation of user‑supplied URLs used by the plugin.

The vulnerability affects installations of the Global Payments WooCommerce plugin version 1.18.0 and earlier on WordPress sites, a commonly deployed payment integration for WooCommerce stores.

With a CVSS score of 5.4, the issue carries moderate severity, while an EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to provide a crafted URL to the plugin, potentially via a site visitor's request or a specially crafted API call, to trigger the SSRF. Although exploitation is unlikely, administrators should still consider patching to prevent potential access to internal networks.