The bSlider WordPress plugin (version 2.0.0 and earlier) contains an SSRF vulnerability (CWE-918) in its fs_api_request function. This flaw allows authenticated users with low privileges (subscriber-level and above) to induce the server to send HTTP requests to arbitrary locations. Such requests originate from the web application itself, potentially enabling attackers to interact with internal network services that are otherwise inaccessible externally. The vulnerability is publicly known and assigned CVE-2025-8680 with a CVSS 3.1 base score of 4.3, indicating medium severity. There is no vendor-provided patch or advisory linked at this time.

An attacker with subscriber-level access or higher can exploit this SSRF vulnerability to make the server send arbitrary HTTP requests. This could lead to unauthorized querying or modification of internal services that the server can reach, potentially exposing sensitive information or enabling further attacks within the internal network. However, the impact is limited to information disclosure (confidentiality) with no direct integrity or availability impact indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to the plugin. Consider disabling or removing the bSlider plugin if it is not essential to reduce exposure.