The Simple Blog Card plugin by Katsushi Kawamori contains a Server-Side Request Forgery vulnerability in versions up to 2.37. This vulnerability allows an attacker with low privileges and no user interaction to cause the server to make unauthorized requests. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and partial confidentiality and integrity impacts without availability impact. No patch or vendor advisory information is currently available.

An attacker with low privileges can exploit this SSRF vulnerability to make the server perform unintended requests, potentially accessing or manipulating internal resources. The impact includes partial loss of confidentiality and integrity, but no impact on availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable plugin and monitor for unusual server requests related to the plugin's functionality. Avoid exposing the plugin to untrusted users if possible.