The EmbedPress WordPress plugin prior to version 4.6.1 fails to validate user-supplied URLs before making server-side HTTP requests through unauthenticated endpoints. This allows unauthenticated attackers to induce the server to send requests to internal network hosts and services that are not covered by WordPress core URL validation. The vulnerability is classified as CWE-918 (Server-Side Request Forgery). No CVSS score or detailed vendor advisory is available, and no patch or remediation level has been confirmed.

An unauthenticated attacker can exploit this vulnerability to cause the affected server to make HTTP requests to internal systems or services that are otherwise inaccessible externally. This can potentially lead to information disclosure or further internal network reconnaissance. However, no known exploits in the wild have been reported, and the exact impact depends on the internal network configuration and services accessible via SSRF.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to unauthenticated endpoints if possible and monitor for unusual outbound HTTP requests from the server. Avoid exposing the vulnerable plugin version in production environments.