CVE-2026-32349 is a Server-Side Request Forgery (SSRF) vulnerability affecting the Andy Fragen Embed PDF Viewer plugin, specifically versions up to 2.4.7. SSRF vulnerabilities enable attackers to make the vulnerable server perform unintended HTTP requests, potentially accessing internal resources or services. The CVSS 3.1 base score is 4.9, reflecting medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity but no impact on availability. No patch or official fix information is available from the vendor, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

The vulnerability allows an attacker with low privileges to cause the server hosting the Embed PDF Viewer to send crafted HTTP requests to arbitrary destinations. This can lead to partial confidentiality and integrity impacts, such as unauthorized access to internal services or data leakage. There is no indication of availability impact or known exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting the server's outbound HTTP requests or applying network-level controls to limit SSRF exploitation.