The vulnerability is a blind Server‑Side Request Forgery that exists in the Ona WordPress theme up to and including version 1.26. It originates from the ona_activate_child_theme routine and allows an authenticated user with administrator privileges to make arbitrary HTTP requests from the server. The attacker can use these requests to probe internal network resources or modify data on services accessible to the web application.

WordPress sites running the Ona theme, any release through version 1.26. The vulnerability is present in all affected versions of the plugin, regardless of minor patch level, and requires administrator‑level authentication to trigger.

The CVSS score of 4.4 reflects a low‑to‑moderate severity for this SSRF. The EPSS score is not available, and the issue is not listed in CISA KEV. Attackers that can authenticate as administrators can exploit the blind SSRF to send requests to internal hosts, potentially exposing sensitive data or altering internal state. The vulnerability is hard to detect without monitoring outbound requests, but its impact on confidentiality and integrity can be substantial if internal services are reachable.