The AI Engine plugin for WordPress (tigroumeow project) contains an SSRF vulnerability (CWE-918) in the rest_helpers_create_images function. Authenticated attackers with Editor or higher privileges can exploit this to send arbitrary HTTP requests originating from the server hosting the plugin. This can lead to unauthorized querying and modification of internal services. Cloud instances are additionally at risk of metadata retrieval. The vulnerability affects all versions up to 3.1.8. No known exploits in the wild have been reported. The CVSS 3.1 base score is 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

An attacker with Editor-level or higher access can abuse this SSRF vulnerability to make arbitrary requests from the server, potentially accessing or modifying internal services that are not otherwise exposed. On cloud-hosted deployments, this may include access to sensitive metadata. The vulnerability does not impact confidentiality of user input directly but can lead to high confidentiality impact on internal resources. Integrity and availability impacts are not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Editor-level access to trusted users only and monitor for suspicious activity. Consider disabling or limiting the use of the rest_helpers_create_images function if possible. Follow updates from the tigroumeow vendor for patch availability.