This vulnerability in WP AVCL Automation Helper (formerly WPFlyLeads) versions up to 3.4 allows an attacker with low privileges to perform Server-Side Request Forgery (SSRF). SSRF vulnerabilities enable attackers to make the server send crafted requests to internal or external systems, potentially exposing sensitive information or interacting with internal services. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, scope changed, and limited confidentiality and integrity impacts.

Successful exploitation could allow an attacker to cause the server to make unintended HTTP requests, potentially leading to information disclosure or interaction with internal network resources. The impact is limited to partial confidentiality and integrity loss, with no availability impact reported. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin functionality to trusted users only and monitor for unusual server-side request activity related to the plugin. Avoid exposing the plugin to untrusted users or inputs that could trigger SSRF.