The Code Embed WordPress plugin by dartiss contains a Server-Side Request Forgery vulnerability (CWE-918) in the ce_get_file() function present in all versions up to 2.5. This vulnerability allows authenticated users with contributor or higher privileges to induce the server to make HTTP requests to arbitrary locations. Such SSRF can be leveraged to access or manipulate internal services that are otherwise inaccessible externally. The CVSS 3.1 base score is 6.4, reflecting a medium impact on confidentiality and integrity but no impact on availability. No patch or remediation details are currently available from the vendor or public advisories.

An attacker with contributor-level or higher access can exploit this SSRF vulnerability to make the server send arbitrary HTTP requests. This can lead to unauthorized querying or modification of internal services and data accessible from the server environment. The impact affects confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious activity related to the Code Embed plugin. Avoid exposing sensitive internal services that could be targeted via SSRF.