{"id":"CVE-2026-12106","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-12106","generatedAt":"2026-10-28T01:02:43.304Z","title":"The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function.","description":"The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application. The plugin uses wp_remote_get() rather than wp_safe_remote_get(), and the validate() method only rejects URLs whose host matches the site's own hostname, failing to block requests to private, loopback, or link-local addresses (e.g., 127.0.0.1, 10.0.0.0/8, 169.254.169.254). Attackers can trigger this by embedding a crafted <img> tag with a src attribute pointing to internal network hosts in post content and submitting it for processing.","published":"2026-09-18T07:16:49.000Z","lastModified":"2026-09-18T15:17:05.000Z","status":"Deferred","sourceIdentifier":"security@wordfence.com","cvss":{"version":"3.1","score":6.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"},"cwe":["CWE-918"],"affected":[],"epss":{"score":0.00348,"percentile":0.28193,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/auto-upload-images/tags/3.3.2/src/ImageUploader.php#L192","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/auto-upload-images/tags/3.3.2/src/ImageUploader.php#L48","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/auto-upload-images/tags/3.3.2/src/WpAutoUpload.php#L45","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/auto-upload-images/tags/3.3.2/src/WpAutoUpload.php#L64","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/auto-upload-images/tags/3.3.2/src/WpAutoUpload.php#L96","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3693206%40auto-upload-images&new=3693206%40auto-upload-images","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/adda0c06-80c7-4e2b-af18-8b2e6258e39a?source=cve","source":"security@wordfence.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-12106","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}