The Podigee plugin contains an SSRF flaw that allows a malicious actor to craft a request that the plugin will forward to an arbitrary URL. When triggered, the plugin may contact internal or external services, potentially leaking sensitive data or enabling further attacks. The weakness is classified as CWE‑918, indicating that untrusted input is used to build a request URL without sufficient validation.

Any WordPress site that has the Podigee plugin installed with a version up to and including 1.4.0 is affected. All releases prior to 1.4.0 meet the criteria described in the advisory. No specific build or configuration limits are cited.

The CVSS score of 5.4 denotes medium severity, and the EPSS score of less than 1% suggests that exploitation is unlikely in the wild. Because the plugin initiates outbound HTTP requests in response to user‑supplied input, the attack vector is inferred to be remote and requires access to the WordPress administrative interface or direct manipulation of the plugin’s configuration. The vulnerability is not listed in CISA’s KEV catalog, indicating that publicly known exploits have not yet been documented.