The utm.codes WordPress plugin through version 1.9.0 contains an SSRF flaw that allows external hosts to craft arbitrary outbound HTTP requests from the infected web server. This weakness can be leveraged to probe internal network resources, download sensitive data or further pivot into protected environments. The CVSS score of 6.4 indicates a moderate to high severity level and represents a risk to confidentiality and integrity of internal systems.

The vulnerability affects the WordPress utm.codes plugin developed by Chris Carlevato, with all releases up to and including version 1.9.0 being vulnerable. WordPress sites that have any of these plugin versions installed are at risk when the plugin processes user‑supplied data to generate requests.

Because the plugin accepts user supplied data for request targets, the flaw falls under CWE‑918 and is typically exploitable by an attacker who can invoke the plugin’s request routine. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. With a CVSS of 6.4, the vulnerability is moderately likely to be targeted; attackers can use the SSRF to reach internal services, potentially facilitating further compromise. The attack does not require any special privileges beyond the ability to interface with the plugin’s functionality.