ProcessWire CMS versions 3.0.255 and earlier contain an SSRF vulnerability in the admin panel’s "Add Module From URL" feature. By providing arbitrary URLs to the module download parameter, an authenticated administrator can cause the server to issue outbound HTTP requests to attacker‑controlled internal or external hosts. The feature’s error messages reveal whether hosts are reachable, enabling reliable internal network port scanning and host enumeration across RFC‑1918 ranges, and exposing sensitive information such as cloud instance metadata.

The vulnerability affects ProcessWire CMS, version 3.0.255 and all earlier releases. Any installation that allows administrators to use the "Add Module From URL" function is susceptible.

The CVSS score is 6.1, indicating Moderate severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires administrative authentication and the ability to use the module import feature. Once authenticated, an attacker can perform internal reconnaissance or obtain privileged metadata without needing external network access.