The Testimonials Widget WordPress plugin fails to validate a user‑supplied Featured Image URL before it retrieves that URL server‑side and stores the response as a public file. This omission allows an attacker to submit arbitrary URLs, causing the host to fetch them. If the URL points to an internal service, the response can be exposed publicly, effectively turning the plugin into an unauthenticated Server‑Side Request Forgery that leaks internal network data.

The flaw affects the WordPress plugin named Testimonials Widget, supplied by Unknown:Testimonials Widget, in all releases up to and including version 4.0.4. No other vendors or products are implicated according to the CNA.

Exploitation requires only a web request to the plugin's public interface; no authentication is necessary, so attackers can target the server from any internet‑connected location. The EPSS score is less than 1 % and the vulnerability is not listed in CISA KEV, but an unpatched host that can reach internal network resources remains vulnerable, and the CVSS score of 5.8 denotes medium severity, indicating that the impact, while not high, can still expose sensitive internal data.