The minnur External Media plugin version 1.0.36 and earlier contains a Server-Side Request Forgery (SSRF) vulnerability. SSRF vulnerabilities enable attackers to make the server perform unintended HTTP requests, which can be leveraged to access internal resources or sensitive information. The CVSS vector indicates the attack requires network access, high attack complexity, low privileges, no user interaction, and impacts confidentiality and integrity with no impact on availability. No patch or official remediation details are currently provided.

An attacker with low privileges can exploit this SSRF vulnerability to cause the server to send crafted requests to internal or external systems. This can lead to limited confidentiality and integrity impacts, such as unauthorized information disclosure or modification of data accessible through the server. There is no indication of availability impact or widespread exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to trusted sources and monitor for unusual server request activity related to the External Media plugin. Avoid exposing the vulnerable plugin to untrusted users or networks where possible.