CVE-2026-22358 is a Server-Side Request Forgery (SSRF) vulnerability affecting SmartDataSoft Electrician - Electrical Service WordPress plugin versions up to 5.6. SSRF vulnerabilities enable attackers to make the server perform unauthorized requests, which can lead to information disclosure or manipulation of internal resources. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction, impacting confidentiality and integrity but not availability. The vulnerability is published and tracked by Patchstack but lacks vendor-provided patch or mitigation details.

The vulnerability allows attackers to cause the server to make unintended requests, potentially exposing internal resources or sensitive information. The CVSS score of 5.4 reflects a medium impact primarily on confidentiality and integrity. There is no indication of availability impact or active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided in the available data, users should monitor vendor communications for updates. Until a fix is available, restricting network access to the affected plugin or disabling it if feasible may reduce risk.