The Ona WordPress theme up to and including version 1.26 contains a Server-Side Request Forgery (SSRF) vulnerability in the ona_activate_child_theme function. This flaw allows authenticated users with administrator-level privileges or higher to make arbitrary web requests from the server, potentially accessing or modifying internal services. The vulnerability has a medium severity rating with a CVSS score of 4.4.