The Grav API plugin prior to version 1.0.16 is vulnerable to server‑side request forgery due to a flaw in webhook delivery. Attackers who control the authoritative DNS for a configured webhook hostname can reply to validation queries with a public address and to delivery queries with a private address, effectively bypassing hostname checks. This technique, known as DNS rebinding, allows the attacker to reach internal network resources or services that would normally be inaccessible from the plugin's execution context. The weakness aligns with CWE‑367, representing a server‑side request forgery that can lead to unauthorized network access.

Affected systems are installations of the Grav API plugin by Getgrav. Any instance running a plugin version earlier than 1.0.16 is impacted. The plugin is distributed under the Grav CMS platform and is commonly deployed across websites that enable webhook integration.

The CVSS score of 6.9 places the vulnerability in the medium severity range, indicating a meaningful risk if exploited. EPSS data is not available, so exploitation likelihood cannot be quantified, and the vulnerability is not yet listed in CISA's KEV catalog. Attack feasibility requires the attacker to control the DNS for a registered webhook hostname; once that is achieved, the attack can traverse internal network boundaries without requiring additional privileges on the host. The combination of medium severity, potential internal threat scope, and reliance on DNS control suggests that the risk warrants prompt remediation, especially for environments exposing privilege to DNS configuration changes.