WordPress Plugin Vulnerabilities

Share This Image < 2.15 - Unauthenticated Server-Side Request Forgery

Description

The Share This Image plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.14. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
share-this-image
Fixed in 2.15

References

CVE
CVE-2026-42641
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/25bdc101-ba13-40fa-97af-75777a2f4bf8

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
7.2 (high)

Miscellaneous

Original Researcher
권민성
Verified
No
WPVDB ID
6e075db3-4d04-49cd-b6e5-c3a3eedb7f48

Timeline

Publicly Published
2026-02-13 (about 5 months ago)
Added
2026-05-12 (about 2 months ago)
Last Updated
2026-05-12 (about 2 months ago)

Other

Published
Title
Published
2024-01-08
Title
Contact Form 7 Extension For Mailchimp < 0.9.19 - Subscriber+ Server-Side Request Forgery
Published
2013-06-21
Title
WordPress 3.5-3.5.1 HTTP API Unspecified Server Side Request Forgery (SSRF)
Published
2019-09-28
Title
Visualizer < 3.3.1 - Blind Server-Side Request Forgery (SSRF)
Published
2025-08-21
Title
WP Crontrol - 1.17.0 - 1.19.1 - Authenticated (Administrator+) Blind Server-Side Request Forgery
Published
2025-10-03
Title
Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery