EUVD-2026-43439Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Network-reachable via plugin URL fetch; low-privilege auth required; high complexity for useful internal endpoint identification; scope change confirmed by SSRF reaching beyond WordPress boundary.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through <= 5.0.4.
AnalysisAI
Server-Side Request Forgery in the Themeisle Auto Featured Image (Auto Post Thumbnail) WordPress plugin through version 5.0.4 enables authenticated low-privilege users to coerce the server into issuing arbitrary outbound HTTP requests to attacker-controlled destinations, including internal network resources. The CVSS scope change (S:C) confirms the vulnerability can reach resources outside the WordPress application boundary - such as cloud metadata endpoints, internal APIs, or services on the hosting network. No public exploit identified at time of analysis, and SSVC assessment confirms no observed exploitation with non-automatable attack conditions.
Technical ContextAI
The affected product is the 'Auto Featured Image (Auto Post Thumbnail)' plugin by Themeisle for WordPress, identified via CPE cpe:2.3:a:themeisle:auto_featured_image_(auto_post_thumbnail):*:*:*:*:*:*:*:*. This plugin automates the assignment of featured images to posts by fetching images from URLs - a functionality class that is inherently prone to CWE-918 (Server-Side Request Forgery) when user-supplied URLs are not sufficiently validated or restricted before the server performs the fetch. The root cause (CWE-918) is the absence of allowlist-based URL validation, which allows an attacker to substitute legitimate image URLs with addresses targeting internal infrastructure such as localhost services, cloud instance metadata endpoints (e.g., 169.254.169.254), or internal load balancers. The CVSS scope change indicates the resulting requests escape the WordPress application trust boundary.
RemediationAI
The primary remediation is to update the Auto Featured Image (Auto Post Thumbnail) plugin to a version beyond 5.0.4; consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/auto-post-thumbnail/vulnerability/wordpress-auto-featured-image-auto-post-thumbnail-plugin-5-0-4-server-side-request-forgery-ssrf-vulnerability for the confirmed patched version, as the input data does not specify an exact fix version - patched release not independently confirmed from available data. As a compensating control while awaiting a patch, restrict WordPress user roles so that only trusted users (editors, administrators) can create or edit posts that trigger image fetching; this directly addresses the PR:L authentication requirement. On cloud-hosted environments, configure instance-level metadata service restrictions (e.g., IMDSv2 enforcement on AWS, or block 169.254.169.254 via host firewall rules) to limit the blast radius of any successful SSRF exploitation. Disabling the plugin entirely eliminates the attack surface with the trade-off of losing automated featured image functionality.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today