CVE-2026-57413: bdthemes Instant Image Generator SSRF in ai-image

CVE-2026-57413 · Severity: medium · CVSS 6.4 · Published 2026-07-13

The Instant Image Generator plugin for WordPress, which uses AI to create images, contains a security flaw that allows authenticated users to make the server perform unauthorized web requests. An attacker could use this to probe internal network services or access sensitive information that is not intended to be public. This could lead to internal data exposure or be used as a stepping stone for further attacks on the organization's infrastructure.

Vendors: BdThemes.

Quick answers

Is CVE-2026-57413 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57413 being exploited in the wild.
How severe is CVE-2026-57413?
Medium severity, with a CVSS score of 6.4, published 13 July 2026.
Which products and versions are affected?
BdThemes Instant Image Generator (ai-image) <= 2.1.4.
Is there a fix for CVE-2026-57413?
A patch was published on 2026-07-13: Patch available in version 2.1.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57413 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57413?
Check whether you run BdThemes Instant Image Generator (ai-image) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the 'ai-image' component of the bdthemes Instant Image Generator plugin for WordPress. The flaw is present in versions up to and including 2.1.4. The vulnerability is classified as CWE-918 and allows an attacker with at least 'Subscriber' level privileges to force the server to make requests to arbitrary external or internal URLs. This can be exploited to bypass firewalls, scan internal networks, or interact with internal services that are otherwise inaccessible from the public internet. The issue is addressed in version 2.1.5.

Affected products

  • bdthemes Instant Image Generator (ai-image) <= 2.1.4

Timeline

  • 2026-05-12: other: Vulnerability reported by ParkHyunWoo
  • 2026-07-08: advisory: Patchstack published advisory
  • 2026-07-13: disclosed: CVE published to NVD
  • 2026-07-13: patched: Patch available in version 2.1.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.