What is the CVSS score of CVE-2026-57413?

CVE-2026-57413 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Instant Image Generator CVE-2026-57413

EUVD-2026-43485 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-13 Patchstack

WordPress SSRF Wordpress Plugin Instant Image Generator Bdthemes

6.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Network-reachable, low complexity, but PR:L required as some WordPress authentication is needed; S:C reflects SSRF reaching systems beyond the vulnerable plugin.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:24 vuln.today

DescriptionCVE.org

Server-Side Request Forgery (SSRF) vulnerability in bdthemes Instant Image Generator ai-image allows Server Side Request Forgery.This issue affects Instant Image Generator: from n/a through <= 2.1.4.

AnalysisAI

Server-Side Request Forgery in bdthemes Instant Image Generator (WordPress plugin ai-image) through version 2.1.4 allows low-privileged authenticated users to coerce the WordPress server into issuing HTTP requests to arbitrary destinations. The scope-changed CVSS vector (S:C) confirms the server can be directed at internal infrastructure beyond the WordPress installation itself, enabling internal network probing or cloud metadata endpoint access. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The affected component is the bdthemes Instant Image Generator WordPress plugin (slug: ai-image), identified by CPE cpe:2.3:a:bdthemes:instant_image_generator:*:*:*:*:*:*:*:*. The plugin is designed to generate images via AI APIs, a workflow that inherently requires server-side HTTP requests to external services. CWE-918 (Server-Side Request Forgery) indicates that user-supplied URL or endpoint input is incorporated into backend HTTP requests without adequate validation or allowlisting. Because the vulnerable code executes in the PHP process hosting WordPress, the forged requests originate from the server's network identity, enabling the attacker to bypass perimeter controls and reach services inaccessible to external clients directly.

RemediationAI

Update the Instant Image Generator plugin beyond version 2.1.4; consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ai-image/vulnerability/wordpress-instant-image-generator-plugin-2-1-4-server-side-request-forgery-ssrf-vulnerability for the confirmed patched release version, which is not independently verified from available input data. If immediate update is not possible, restrict the plugin's functionality to trusted user roles only via WordPress capability controls, reducing the pool of users who can trigger image generation requests. Where the WordPress server runs in a cloud environment, apply instance metadata service protection (e.g., IMDSv2 on AWS, or block 169.254.169.254 via host firewall rules) to prevent cloud credential theft via SSRF - this mitigation does not address internal network probing but removes the most high-impact SSRF target. Network-level egress filtering on the WordPress host to allowlist only known AI API endpoints will further limit SSRF reach, at the cost of restricting future plugin functionality.