The Remote Content Shortcode WordPress plugin (versions up to 1.5) contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exploitable through the remote_content shortcode. Authenticated users with at least contributor privileges can leverage this flaw to cause the server to make HTTP requests to arbitrary locations. This behavior can be abused to interact with internal network services or external systems from the context of the vulnerable web application. The CVSS 3.1 base score is 6.4, reflecting a medium impact with low attack complexity and requiring privileges. No known exploits in the wild or vendor patches are currently documented.

An attacker with contributor-level or higher access can exploit this SSRF vulnerability to make the vulnerable WordPress server send arbitrary HTTP requests. This may lead to unauthorized querying or modification of internal services accessible from the server, potentially exposing sensitive information or enabling further attacks within the internal network. The confidentiality and integrity of internal resources can be partially compromised. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity related to the remote_content shortcode usage. Avoid exposing internal services that could be targeted via SSRF from the WordPress server.