CVE-2026-12106 json
Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags
published 2026-09-18 52 d ago modified 2026-09-18 52 d ago also EUVD-2026-82730
- cvss
- 6.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application. The plugin uses wp_remote_get() rather than wp_safe_remote_get(), and the validate() method only rejects URLs whose host matches the site's own hostname, failing to block requests to private, loopback, or link-local addresses (e.g., 127.0.0.1, 10.0.0.0/8, 169.254.169.254). Attackers can trigger this by embedding a crafted <img> tag with a src attribute pointing to internal network hosts in post content and submitting it for processing.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 52 d ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Affected products
- airani Auto Upload Images
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/adda0c06-80c7-4e2b-af18-8b2e6258e39a?source=cve
- plugins.trac.wordpress.org /browser/auto-upload-images/tags/3.3.2/src/ImageUploader.php#L192
- plugins.trac.wordpress.org /browser/auto-upload-images/tags/3.3.2/src/ImageUploader.php#L48
- plugins.trac.wordpress.org /browser/auto-upload-images/tags/3.3.2/src/WpAutoUpload.php#L45
- plugins.trac.wordpress.org /browser/auto-upload-images/tags/3.3.2/src/WpAutoUpload.php#L64
- plugins.trac.wordpress.org /browser/auto-upload-images/tags/3.3.2/src/WpAutoUpload.php#L96
- plugins.trac.wordpress.org /changeset?reponame=&old=3693206%40auto-upload-images&new=3693206%40auto-upload-images
Sources
- CVE List CVE-2026-12106
- NVD CVE-2026-12106
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.