Executive brief
The Auto Upload Images WordPress plugin allows authenticated users with contributor-level access to trigger web requests from the server to internal or private network addresses. An attacker could exploit this to probe internal infrastructure, access private APIs, or reach administrative interfaces not exposed to the public internet, potentially leading to data theft or lateral movement within an organization's network.
Technical details
The vulnerability is a limited server-side request forgery (SSRF) in the downloadImage function of the Auto Upload Images plugin. The plugin uses wp_remote_get() instead of the safer wp_safe_remote_get() function, and its validate() method only blocks URLs matching the site's own hostname, failing to reject private address ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254). An authenticated attacker with contributor-level or higher privileges can embed a malicious <img> tag with a crafted src attribute in post content, causing the plugin to make requests to arbitrary internal network hosts. This requires authentication and user interaction (post submission), but allows reconnaissance and potential exploitation of internal services.
Affected products
- WordPress Auto Upload Images up to and including 3.3.2
Timeline
- 2026-09-18: disclosed