The SmartAIPress WordPress plugin contains a critical Server-Side Request Forgery vulnerability that allows authenticated users to read arbitrary internal or external network resources.

This flaw exists because the plugin fails to perform capability checks on a specific AJAX endpoint and lacks validation for user-supplied URLs, allowing any authenticated user with subscriber-level access to trigger server-side requests.

This vulnerability poses a significant risk to internal network security by enabling attackers to bypass firewalls and interact with internal services that are not exposed to the public internet. The CVSS score of 7.7 reflects a high-severity risk, as it could lead to the unauthorized disclosure of sensitive configuration data, cloud metadata, or internal API responses, potentially resulting in full system compromise.

Immediate Action: Since a specific patch is currently unknown, administrators should immediately deactivate and uninstall the SmartAIPress plugin until an official update is released by the vendor.

Proactive Monitoring: Monitor server access logs and outbound network traffic for unusual requests originating from the web server to internal IP addresses or sensitive external endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious AJAX requests and sanitize URL parameters to prevent outbound SSRF attempts.

Public Exploit Available: No — there is no confirmed public exploit or proof-of-concept available in the provided data.

Given the potential for unauthorized access to internal infrastructure, this vulnerability should be treated with high priority. Users are strongly advised to remove the vulnerable plugin from their WordPress environments immediately and monitor for official vendor communications regarding a security update. Relying on network-level egress filtering can provide additional defense-in-depth until the plugin is properly patched.