CVE-2026-2479

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.1. This is due to the use of `strpos()` for substring-based hostname validation instead of strict host comparison in the `ajax_upload_image()` function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services.

• CWE-918

• https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.7.0/includes/class-remote-library.php#L329
• https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.7.0/includes/class-remote-library.php#L344
• https://plugins.trac.wordpress.org/browser/responsive-lightbox/trunk/includes/class-remote-library.php#L329
• https://plugins.trac.wordpress.org/changeset/3464566?contextall=1
• https://www.wordfence.com/threat-intel/vulnerabilities/id/44276b28-9509-4f59-936c-fff2ae404076?source=cve

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24782Kiteworks is a private data network (PDN). Prior to version …8.8
• CVE-2026-24783soroban-fixed-point-math is a fixed-point math library for S…7.5
• CVE-2026-24784DNN (formerly DotNetNuke) is an open-source web content mana…4.8
• CVE-2026-24785Clatter is a no_std compatible, pure Rust implementation of …9.1
• CVE-2026-24788RaspAP raspap-webgui versions prior to 3.3.6 contain an OS c…8.8
• CVE-2026-24789An unprotected API endpoint allows an attacker to remotely c…9.8
• CVE-2026-24790The underlying PLC of the device can be remotely influenced,…8.2
• CVE-2026-24791Public-only tokens bypass private-resource restrictions on `…8.1
• CVE-2026-24792in OpenHarmony v6.0 and prior versions allow a remote attack…8.1
• CVE-2026-24793Out-of-bounds Write, Buffer Copy without Checking Size of In…9.8
• CVE-2026-24794Improper Restriction of Operations within the Bounds of a Me…9.2
• CVE-2026-24795Out-of-bounds Write vulnerability in CloverHackyColor Clover…5.1