The Fluent Forms Pro Add On Pack plugin for WordPress contains an SSRF vulnerability (CWE-918) in the 'saveDataSource' function present in all versions up to 6.1.12. This vulnerability allows authenticated users with at least Subscriber privileges to induce the server to send crafted HTTP requests to arbitrary locations. Such requests originate from the web application itself, potentially enabling attackers to access or modify internal network resources that are otherwise inaccessible externally. The CVSS 3.1 base score is 5.4, reflecting a medium impact on confidentiality and integrity, with no impact on availability. No patch or official fix details are currently available, and no public exploits have been reported.

An attacker with authenticated access at Subscriber level or higher can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests. This can lead to unauthorized querying and modification of internal services or data accessible from the server's network context. The impact affects confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to minimize exposure, and monitor for suspicious activity related to the 'saveDataSource' function. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor channels for updates on patches or official mitigations.