WordPress Plugin Vulnerabilities

Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url Parameter

Description

The plugin does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses.

Proof of Concept

Affects Plugins

Plugin icon
feed-instagram-lite
No known fix

References

CVE
CVE-2026-105967

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
João Ramos Maciel
Submitter
João Ramos Maciel
Submitter website
https://treesec.com.br/
Verified
Yes
WPVDB ID
30dffd34-b7e5-4afc-809b-abb5c9d20590

Timeline

Publicly Published
2026-10-31 (about 2 days ago)
Added
2026-10-24 (about 9 days ago)
Last Updated
2026-10-24 (about 9 days ago)

Other

Published
Title
Published
2024-05-21
Title
MemberPress < 1.11.30 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode
Published
2026-02-14
Title
Simple Blog Card < 2.38 - Authenticated (Contributor+) Server-Side Request Forgery
Published
2025-04-24
Title
Animate <= 0.5 - Authenticated (Contributor+) Server-Side Request Forgery
Published
2026-11-02
Title
FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import
Published
2025-11-27
Title
Pool Services <= 3.3 - Unauthenticated Server-Side Request Forgery