WordPress Plugin Vulnerabilities

SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image

Description

The plugin does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external URLs and read the response, resulting in a full-read Server-Side Request Forgery.

Proof of Concept

Affects Plugins

Plugin icon
smartaipress
No known fix

References

CVE
CVE-2026-16600

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
7.7 (high)

Miscellaneous

Original Researcher
Benjamin Aguayo
Submitter
Benjamin Aguayo
Verified
Yes
WPVDB ID
66d2dc2d-fe77-4d34-bfca-d47b086a9c96

Timeline

Publicly Published
2026-08-27 (about 2 days ago)
Added
2026-08-27 (about 2 days ago)
Last Updated
2026-08-27 (about 2 days ago)

Other

Published
Title
Published
2025-09-09
Title
Auto Save Remote Images (Drafts) <= 1.0.9 - Authenticated (Contributor+) Server-Side Request Forgery
Published
2023-07-13
Title
HTTP Headers < 1.19.0 - Admin+ SSRF
Published
2026-07-22
Title
Photo Block – A Modern Image Block With Lightbox and Caption Support <= 1.7.1 - Authenticated (Author+) Sever-Side Request Forgery
Published
2025-06-26
Title
Ninja Tables – Easy Data Table Builder < 5.0.19 - Unauthenticated Server-Side Request Forgery
Published
2025-01-23
Title
Activity Plus Reloaded for BuddyPress < 1.1.2 - Authenticated (Subscriber+) Blind Server-Side Request Forgery