The vulnerability identified as CVE-2025-22346 is a Server-Side Request Forgery (CWE-918) in the Course Migration for LearnDash plugin by Faizaan Gagan, specifically affecting version 1.0.2. SSRF vulnerabilities allow an attacker with some level of access to cause the server to make HTTP requests to arbitrary domains, which can lead to information disclosure or manipulation of internal resources. The CVSS v3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity. The vulnerability is published and recognized but lacks an official fix or patch at this time.

An attacker with low privileges can exploit this SSRF vulnerability to make the server perform unintended requests, potentially accessing or modifying sensitive information within the server's network context. The impact is limited to partial confidentiality and integrity loss, with no direct availability impact reported. No known active exploitation has been reported.

No official patch or remediation is currently available for this vulnerability. Users of the affected plugin version 1.0.2 should monitor vendor advisories for updates. In the absence of a fix, restricting network access from the server to only trusted endpoints and limiting plugin usage to trusted users may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.