This vulnerability (CVE-2026-66437) in Themeisle Feedzy plugin versions up to 5.2.4 is classified as CWE-918 (Server-Side Request Forgery). It allows an attacker with contributor-level privileges to cause the server to send crafted requests to internal or external resources. The CVSS 3.1 base score is 4.9 (medium), with network attack vector, high attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity. No vendor advisory or patch information is currently provided, and no known exploits have been reported.

An attacker with contributor privileges can exploit this SSRF vulnerability to make the server perform unauthorized requests, potentially leading to limited information disclosure or interaction with internal systems. The impact is rated medium with partial confidentiality and integrity impact but no availability impact. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level user privileges where possible and monitor for unusual server request activity related to Feedzy. Avoid exposing sensitive internal resources that could be targeted via SSRF.