What is the CVSS score of CVE-2026-22482?

CVE-2026-22482 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2026-22482?

A critical Server-Side Request Forgery vulnerability in IMGspider (versions ≤2.3.12) allows attackers to make unauthorized requests from affected servers, potentially accessing internal systems,…

How to fix or mitigate CVE-2026-22482?

Within 24 hours: Inventory all systems running IMGspider and isolate affected instances from production if possible; establish continuous monitoring for exploitation attempts. Within 7 days: Contact wbolt.com for patch availability and deployment timeline; implement compensating controls (WAF rules, network segmentation). Within 30 days: Deploy patched version immediately upon release; conduct forensic review for evidence of prior exploitation.

Wordpress Plugin CVE-2026-22482

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-01-22 audit@patchstack.com

WordPress SSRF Wordpress Plugin

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

CRITICAL MEDIUM

CVSS changed

Apr 23, 2026 - 15:43 NVD

9.1 (CRITICAL) 4.9 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:16 nvd

CRITICAL 9.1

DescriptionCVE.org

Server-Side Request Forgery (SSRF) vulnerability in wbolt.com IMGspider imgspider allows Server Side Request Forgery.This issue affects IMGspider: from n/a through <= 2.3.12.

AnalysisAI

IMGspider WordPress plugin has a Server-Side Request Forgery vulnerability enabling attackers to make the server perform requests to internal network resources.

Technical ContextAI

The IMGspider plugin by wbolt.com has a CWE-918 SSRF vulnerability that allows attackers to make the WordPress server send HTTP requests to arbitrary internal and external destinations.