The Ninja Forms Webhooks plugin for WordPress contains a Server-Side Request Forgery vulnerability (CWE-918) in versions up to 3.0.7. Authenticated attackers with Administrator privileges can exploit the form webhook functionality to cause the server to send HTTP requests to arbitrary locations. This could allow attackers to interact with internal network services that are not otherwise accessible externally. The CVSS 3.1 base score is 5.5, reflecting a medium severity with network attack vector, low attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with Administrator-level access can leverage this SSRF vulnerability to make the server perform arbitrary HTTP requests. This may lead to unauthorized information disclosure or modification of internal services accessible from the server. The vulnerability does not impact availability. No public exploits are currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to webhook configurations. Avoid exposing sensitive internal services that could be targeted via SSRF.