Asset CleanUp CVE-2026-12037

Two concrete prerequisites gate exploitation: (1) the attacker must hold WordPress administrator-level access or above (PR:H), and (2) the plugin's dom_get_type setting must be configured to 'wp_remote_post', which is an administrator-controlled, non-default option - when set to other values the vulnerable page_url request path is not reached. Given both conditions, the SSRF is triggered via the 'page_url' parameter and the server issues requests to attacker-chosen internal or external locations. The limiting factors are the high privilege requirement and the specific non-default configuration, which together make untargeted, opportunistic exploitation unlikely; no user interaction is required (UI:N).

This is a genuine but low-priority issue rather than an urgent one. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N, base 5.5 Medium) is network-reachable and low-complexity, but the PR:H requirement is the dominant limiting factor: the attacker must already hold administrator-level access. An administrator on a WordPress site can already install plugins, edit PHP, and pivot in many ways, so this SSRF adds marginal capability (blind/limited internal requests) on top of an already-powerful role. The scope change (S:C) and C:L/I:L reflect that the requests originate from the server and can reach internal-only services, which is the real value to an attacker in segmented environments. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Additionally, exploitation is conditional on a non-default setting (dom_get_type = 'wp_remote_post'), which further narrows the realistic attack surface. Net: legitimate SSRF, but high-privilege prerequisite plus a required non-default configuration make this a low real-world risk despite network reachability.

An attacker who has already obtained (or been granted) WordPress administrator access on a site running Asset CleanUp, and where the dom_get_type setting is configured to 'wp_remote_post', supplies a crafted 'page_url' value pointing at an internal service (e.g., a cloud metadata endpoint or an internal admin panel). The plugin issues a server-side request to that URL, letting the attacker query or manipulate internal-only resources not otherwise reachable from outside. No public exploit code is identified at time of analysis.