WordPress Plugin Vulnerabilities

PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects

Description

The plugin does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.

Proof of Concept

Affects Plugins

Plugin icon
powerpress
Fixed in 11.17.11

References

CVE
CVE-2026-97354

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
4.1 (medium)

Miscellaneous

Original Researcher
Raj Ukani
Submitter
Raj Ukani
Submitter twitter
rajukani100
Verified
Yes
WPVDB ID
473239c2-0b66-466b-98ac-391dad2853b9

Timeline

Publicly Published
2026-10-05 (about 2 days ago)
Added
2026-10-05 (about 1 day ago)
Last Updated
2026-10-05 (about 1 day ago)

Other

Published
Title
Published
2024-07-29
Title
Edubin <= 9.2.0 - Unauthenticated Server-Side Request Forgery
Published
2025-01-03
Title
Course Migration for LearnDash <= 1.0.2 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2026-03-20
Title
Post Affiliate Pro < 1.29.1 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field
Published
2023-04-26
Title
Booking Manager < 2.0.29 - Subscriber+ SSRF
Published
2026-01-05
Title
Xagio SEO < 7.1.0.31 - Authenticated (Subscriber+) Server-Side Request Forgery