The Gravity Forms WebHooks plugin for WordPress contains an SSRF vulnerability (CWE-918) in the 'process_feed' method of the GF_Webhooks class. Authenticated attackers with Administrator privileges can exploit this flaw to make web requests to arbitrary locations from the server hosting the plugin. This could allow attackers to access or manipulate internal services that are otherwise not directly accessible externally. The vulnerability affects all plugin versions up to and including 1.6.0. No known exploits in the wild have been reported, and no patch or remediation details are currently available.

An attacker with Administrator-level access can leverage this SSRF vulnerability to send crafted requests from the server to arbitrary internal or external endpoints. This may lead to unauthorized information disclosure or modification of internal services accessible from the server. The impact is limited by the requirement for high privileges (Administrator access) and does not directly allow remote unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only. Monitor for updates from Gravity Forms regarding a patch or official mitigation steps.