The vulnerability is an unauthenticated Server Side Request Forgery (SSRF) that allows an attacker to instruct the WordPress site to make arbitrary HTTP or HTTPS requests to any internal or external addresses. By manipulating the plugin’s input, an attacker could retrieve sensitive data from backend services, conduct port scanning, or facilitate other network attacks. The flaw resides in CWE‑918 and can compromise confidentiality and availability of internal resources if the site has access to network endpoints.

The affected product is the PDF Smart Viewer for Elementor plugin released by DeKnows. All versions up to and including 1.0.4 are vulnerable, as these releases lack the necessary input validation to prevent SSRF. Any WordPress installation using these versions is at risk.

With a CVSS score of 7.2, the vulnerability is considered high severity. The EPSS score of 0.00255 (less than 1%) indicates a very low but nonzero exploitation probability, which suggests that active exploitation likelihood is currently low. Since the vulnerability is not listed in the CISA KEV catalog, there is no confirmation of active exploitation yet. The likely attack vector is a publicly accessible web request that an attacker can fabricate to trigger the SSRF via the plugin’s exposed functionality. The attack does not require privileged access to the server or plugin credentials, making it low barrier to exploitation for external actors.