This vulnerability (CWE-918) in Pexels: Free Stock Photos allows an attacker with low privileges to perform Server-Side Request Forgery (SSRF), potentially causing the server to make unauthorized requests. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. The affected versions include all versions up to 1.2.2. No patch or official remediation level has been provided by the vendor or authoritative sources as of the publication date.

An attacker with low privileges can exploit this SSRF vulnerability to cause the server to send crafted requests, potentially leading to unauthorized information disclosure or modification. The impact is limited to confidentiality and integrity with no direct availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for unusual server request activity related to SSRF. Avoid exposing the vulnerable functionality to untrusted users where possible.