The Google Doc Embedder plugin for WordPress (levertechadmin) contains an SSRF vulnerability (CWE-918) in the 'gview' shortcode functionality in versions up to 2.6.4. This allows authenticated users with contributor or higher privileges to induce the server to make arbitrary HTTP requests to internal or external systems. The vulnerability can be leveraged to access or modify information on internal services reachable from the server. The CVSS 3.1 score is 6.4 (medium severity), with attack vector network, low attack complexity, requiring privileges, no user interaction, and partial impact on confidentiality and integrity. No patch or official fix is currently documented, and no public exploit is known.

An authenticated attacker with contributor-level permissions or above can exploit this SSRF vulnerability to make arbitrary HTTP requests from the server hosting the WordPress site. This could lead to unauthorized querying or modification of internal services accessible from the server, potentially exposing sensitive information or altering internal data. The impact affects confidentiality and integrity partially, with no direct availability impact reported.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the Google Doc Embedder plugin if it is not essential. Monitor for vendor updates regarding patches or official mitigations.