A critical Server-Side Request Forgery vulnerability in the Content Syndication Toolkit plugin allows unauthenticated attackers to perform unauthorized requests from the host server.

This vulnerability occurs because the plugin registers an unauthenticated AJAX endpoint that accepts arbitrary URLs via the url parameter without validation. Because the underlying code uses an insecure request method, an unauthenticated attacker can force the server to fetch external resources or interact with internal network services.

The ability to perform Server-Side Request Forgery poses a significant risk to internal infrastructure. An attacker can leverage this flaw to scan internal network ports, access sensitive cloud metadata services, or interact with internal applications that are otherwise protected by a firewall. Given the CVSS score of 7.2, this vulnerability represents a high risk to data confidentiality and integrity.

Immediate Action: Since a patched version is currently unavailable, administrators should immediately deactivate and remove the Content Syndication Toolkit plugin from all WordPress installations until a vendor-supplied update is released.

Proactive Monitoring: Monitor web server logs for suspicious requests to the wp-admin/admin-ajax.php endpoint, particularly those containing references to internal IP addresses or cloud metadata service URLs.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests targeting the redux_p AJAX action, which may provide temporary protection against exploitation attempts.

Public Exploit Available: Unknown

This vulnerability presents a clear path for unauthorized network reconnaissance and potential data exfiltration from internal environments. Due to the lack of a verified patch, the most effective security posture is to remove the vulnerable component entirely. Security teams should prioritize identifying and decommissioning instances of this plugin to eliminate the exposure window.