This vulnerability in WP eBay Product Feeds (<= 3.4.8) allows an attacker with low privileges to perform Server-Side Request Forgery (SSRF), where the server can be tricked into making unintended requests. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. The vulnerability is published and assigned CVE-2025-58977 but lacks specific patch or mitigation details.

An attacker with low privileges can exploit this SSRF vulnerability to cause the server to make unauthorized requests, potentially exposing internal resources or sensitive information, and affecting confidentiality and integrity. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and limit privileges of users who can interact with it to reduce risk. Monitor for updates from Rhys Wynne regarding patches or official mitigations.