High · published February 5, 2026
⚡ A sneaky Server-Side Request Forgery vulnerability lurks in the All In One Image Viewer Block plugin for WordPress, affecting all versions up to 1.0.2! Think of it as a delivery service that accepts any address without verifying it — a courier might just end up delivering sensitive information to the wrong place! If exploited, an attacker could manipulate the web application to make requests to internal services, opening the door to unauthorized data access or even changes to sensitive configurations. This could lead to devastating consequences for your site and its users!
Think of it as a delivery service that accepts any address without verifying it — a courier might just end up delivering sensitive information to the wrong place! This vulnerability arises from missing authorization and URL validation on the image-proxy REST API endpoint, allowing unauthenticated attackers to send requests to arbitrary locations.
If exploited, an attacker could manipulate the web application to make requests to internal services, opening the door to unauthorized data access or even changes to sensitive configurations. This could lead to devastating consequences for your site and its users! Immediately update the All In One Image Viewer Block plugin to version 1.0.3 or later to patch this vulnerability. Additionally, review your access controls and API validation to ensure proper security measures are in place. You've got this! By following these steps, you'll boost your site's security in no time! 🛡️