The vulnerability is an unauthenticated Server Side Request Forgery (SSRF) flaw in WordPress FormCraft plugin versions 3.9.15 and earlier. An attacker can submit a crafted form that causes the plugin to issue HTTP requests to arbitrary URLs, including internal or hidden services. This flaw could lead to data discovery, internal network exposure, or further exploitation of services reached through the forged requests.

The affected product is the FormCraft WordPress plugin developed by Subtle Web Inc. Versions up to and including 3.9.15 are vulnerable. All installations of these versions that are publicly accessible are at risk.

The CVSS score of 7.2 places this issue in the high severity range. The EPSS score is 0.00159, indicating a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is unauthenticated and can be triggered via any form submission, an attacker with internet access to the site can exploit it without needing credentials. The typical attack flow involves submitting a specially crafted form that includes a URL pointing to an internal endpoint or an arbitrary external address. The plugin processes this input and performs the request server‑side, making the target of the request appear to come from the WordPress host. If internal resources are accessible, sensitive data could be read or abused. Given the lack of authentication requirements and the ability to target arbitrary addresses, exploit potential is high in environments with exposed FormCraft forms.