The Seraphinite Accelerator plugin for WordPress contains an SSRF vulnerability (CWE-918) in the OnAdminApi_HtmlCheck function. This flaw allows authenticated users with subscriber-level privileges or higher to induce the server to send crafted HTTP requests to arbitrary locations. This can be leveraged to interact with internal network services or resources that are otherwise inaccessible externally. The vulnerability affects all plugin versions up to 2.20.52. There is no vendor-provided patch or advisory linked in the available data.

An attacker with at least subscriber-level access can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests. This may lead to unauthorized querying or modification of internal services, potentially exposing sensitive information or enabling further attacks within the internal network. The impact is limited to confidentiality and integrity with no direct availability impact noted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to the plugin. Avoid exposing internal services that could be targeted via SSRF. Follow vendor channels for updates on patches or official mitigations.