CVE-2026-12106

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application. The plugin uses wp_remote_get() rather than wp_safe_remote_get(), and the validate() method only rejects URLs whose host matches the site's own hostname, failing to block requests to private, loopback, or link-local addresses (e.g., 127.0.0.1, 10.0.0.0/8, 169.254.169.254). Attackers can trigger this by embedding a crafted <img> tag with a src attribute pointing to internal network hosts in post content and submitting it for processing.

• CWE-918

• https://plugins.trac.wordpress.org/browser/auto-upload-images/tags/3.3.2/src/ImageUploader.php#L192
• https://plugins.trac.wordpress.org/browser/auto-upload-images/tags/3.3.2/src/ImageUploader.php#L48
• https://plugins.trac.wordpress.org/browser/auto-upload-images/tags/3.3.2/src/WpAutoUpload.php#L45
• https://plugins.trac.wordpress.org/browser/auto-upload-images/tags/3.3.2/src/WpAutoUpload.php#L64
• https://plugins.trac.wordpress.org/browser/auto-upload-images/tags/3.3.2/src/WpAutoUpload.php#L96
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3693206%40auto-upload-images&new=3693206%40auto-upload-images
• https://www.wordfence.com/threat-intel/vulnerabilities/id/adda0c06-80c7-4e2b-af18-8b2e6258e39a?source=cve

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12100The URL Preview plugin for WordPress is vulnerable to Server…7.2
• CVE-2026-12101IBM Verify Identity Access could allow an administrator to e…8.1
• CVE-2026-12102The UsersWP – Front-end login form, User Registration, User …2.7
• CVE-2026-12103The Wallet for WooCommerce plugin for WordPress is vulnerabl…4.3
• CVE-2026-12104OS command injection in the environment and tunnel configura…8.6
• CVE-2026-12105Improper access control in Devolutions Server 2026.2.5, 2026…6.5
• CVE-2026-12108The Highlighting Code Block plugin for WordPress is vulnerab…4.4
• CVE-2026-12110The Taskbuilder – Project Management & Task Management Tool …6.5
• CVE-2026-12111The Appointment Booking Calendar plugin for WordPress is vul…4.3
• CVE-2026-12112A flaw was found in the foreman-mcp-server. A session manage…7.8
• CVE-2026-12113The Appointment Booking Calendar plugin for WordPress is vul…4.3
• CVE-2026-12114The Team Members – Multi Language Supported Team Plugin plug…4.4