Koen Reus vulnerabilities and threats

Post to Google My Business plugin for WordPress versions before 3.5.7 contains a blind server-side request forgery (SSRF) vulnerability. Authenticated users with Contributor-level privileges or higher can exploit this flaw by supplying a crafted URL that triggers the server to send requests to arbitrary hosts. This allows attackers to perform internal port scanning, probe internal-only services and cloud metadata endpoints, and cause GET-based side effects on internal systems, bypassing network perimeter controls. The vulnerability is fixed in version 3.5.7.