The Uncanny Automator plugin for WordPress contains an SSRF vulnerability in the 'call_webhook' method of the Automator_Send_Webhook class affecting all versions up to 6.2. Authenticated attackers with Administrator privileges can exploit this to send crafted requests from the server to arbitrary locations, potentially interacting with internal network resources. The CVSS 3.1 base score is 5.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with Administrator-level access can leverage this SSRF vulnerability to make unauthorized requests from the server to internal or external systems. This could lead to unauthorized information disclosure or modification of internal services accessible from the server. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator access to trusted users only and monitor for unusual webhook activity. Avoid exposing sensitive internal services that could be targeted via SSRF.