The nK Themes Helper plugin (versions up to 1.7.9) contains a Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2025-22726. This vulnerability allows an attacker with low privileges and no user interaction to cause the server to make unintended requests, which can lead to partial compromise of confidentiality and integrity. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact. No patch or vendor advisory details are currently available.

An attacker with low privileges can exploit this SSRF vulnerability to make the server perform unauthorized requests, potentially accessing internal resources or sensitive information. The impact is limited to partial confidentiality and integrity loss, with no availability impact reported. There are no known active exploits in the wild, reducing immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting outbound server requests where possible and monitoring for unusual server-side request activity related to the nK Themes Helper plugin.