The apprhyme URL Media Uploader WordPress plugin versions up to 1.0.0 contain a Server-Side Request Forgery vulnerability (CWE-918) exploitable via the 'url_media_uploader_url_upload' action. Authenticated attackers with author-level or higher privileges can leverage this to induce the server to make arbitrary HTTP requests, potentially accessing or modifying internal network resources. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.4 (Network attack vector, low attack complexity, privileges required, no user interaction, scope changed, low confidentiality and integrity impact, no availability impact). There is no vendor-provided patch or official remediation guidance available at this time.

Successful exploitation allows authenticated users with author-level or higher permissions to make arbitrary HTTP requests from the server hosting the vulnerable plugin. This can lead to unauthorized querying or modification of internal services that are otherwise inaccessible externally. The confidentiality and integrity impacts are rated low, and availability is not affected. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level and higher access to trusted users only. Monitor for updates from the apprhyme plugin vendor or WordPress security advisories. Avoid exposing sensitive internal services that could be targeted via SSRF.