This vulnerability in the minnur External Media plugin (versions <= 1.0.36) allows an attacker with low privileges to perform Server-Side Request Forgery (SSRF). SSRF vulnerabilities enable attackers to make the vulnerable server send crafted requests to internal or external resources, potentially exposing sensitive information or enabling further attacks. The CVSS 3.1 vector indicates the attack requires network access, high attack complexity, low privileges, no user interaction, and impacts confidentiality and integrity with no effect on availability.

An attacker with low privileges can exploit this SSRF vulnerability to cause the server to make unauthorized requests, potentially leading to limited confidentiality and integrity impacts. There is no indication of availability impact. No known exploits are reported in the wild, and the overall severity is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates. Until a fix is available, restrict access to the vulnerable plugin and limit network exposure where possible.