The Church Admin plugin for WordPress contains an SSRF vulnerability (CWE-918) due to inadequate validation of the 'audio_url' parameter. This allows authenticated administrators to cause the server to make HTTP requests to arbitrary URLs, potentially accessing or manipulating internal network resources. The vulnerability affects all versions up to and including 5.0.28. The CVSS 3.1 base score is 2.2, reflecting low impact with high attack complexity and required privileges. No known exploits are reported in the wild, and no patch or remediation details are provided.

An attacker with Administrator privileges can leverage this SSRF vulnerability to make the server perform arbitrary HTTP requests. This could lead to unauthorized querying or modification of internal services accessible from the server. However, the impact is limited by the requirement for high privileges and the low CVSS score, indicating no direct confidentiality or availability impact is confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator access to trusted users only and monitor for suspicious activity related to the 'audio_url' parameter. Avoid exposing internal services unnecessarily to reduce potential impact.