An issue exists where the plugin fails to validate the destination of redirects when fetching a user-supplied media URL. This allows authenticated users with the contributor role and above to perform Server-Side Request Forgery (SSRF) attacks, which is a technique used to induce the server-side application to make requests to an unintended location. This can be used to query and modify information from internal services.