EUVD-2026-26212Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Network-accessible WordPress plugin, no auth required, but AC:H reflects non-trivial exploitation; S:C and C:L/I:L capture SSRF's lateral reach to internal systems without direct code execution.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in ILLID Share This Image share-this-image allows Server Side Request Forgery.This issue affects Share This Image: from n/a through <= 2.14.
AnalysisAI
Server-Side Request Forgery in the ILLID Share This Image WordPress plugin (all versions through 2.14) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external destinations, potentially exposing internal network topology and services. The scope-changed CVSS vector (S:C) confirms that exploitation can extend impact beyond the vulnerable WordPress instance to backend systems reachable by the server. No public exploit code has been identified and SSVC assessment classifies exploitation as none at time of analysis, placing real-world urgency below the raw CVSS 5.4 score suggests.
Technical ContextAI
Share This Image (CPE: cpe:2.3:a:illid:share_this_image:*:*:*:*:*:*:*:*) is a WordPress plugin authored by ILLID that provides image-sharing functionality. The vulnerability is classified as CWE-918 (Server-Side Request Forgery), a class of flaw in which the application fetches a remote resource based on attacker-supplied URL input without adequate validation of the destination. Because WordPress plugins frequently implement image-fetching or proxy features to circumvent hotlink restrictions or load remote assets, the plugin likely passes user-controlled URL parameters to a server-side HTTP client (such as wp_remote_get or cURL). This allows the attacker to redirect those requests to loopback addresses, cloud metadata endpoints (e.g., 169.254.169.254), or other internal services that are not directly reachable from the public internet. The high complexity rating (AC:H) in the CVSS vector suggests that exploitation is not straightforward and may require specific request conditions or timing.
RemediationAI
No specific patched version number is provided in the available input data; the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/share-this-image/vulnerability/wordpress-share-this-image-plugin-2-14-server-side-request-forgery-ssrf-vulnerability should be consulted for the confirmed fixed release. Site administrators running Share This Image 2.14 or earlier should check the WordPress plugin repository for an updated version and apply it immediately. If no patch is yet available, a compensating control is to deactivate the plugin until a fix is released, accepting the trade-off of losing the image-sharing functionality. Additionally, WordPress environments hosted in cloud infrastructure (AWS, GCP, Azure) should enforce IMDSv2 (instance metadata service v2) or equivalent metadata endpoint hardening to limit the blast radius of any SSRF exploitation. Web Application Firewall rules blocking outbound requests to RFC-1918 address ranges and cloud metadata IP addresses from the application tier provide an additional layer of defense.
More in Share This Image
View allMultiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in v
The Share This Image plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.03. Rat
The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STI Buttons shor
The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alignment' parameter in
Missing authorization in ILLID Share This Image WordPress plugin through version 2.12 allows unauthenticated remote atta
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today