PHP EUVD-2026-21649

This vulnerability presents moderate real-world risk with important caveats. The CVSS score of 5.0 (Medium) reflects the attack vector (network-accessible), low attack complexity, and requirement for authenticated access (PR:L). The scope change (S:C) to another security domain combined with confidentiality impact (C:L) indicates the ability to gather sensitive information via internal network scanning. The EPSS exploitation probability is not explicitly provided but the straightforward nature of the attack-simply crafting a POST request with a malicious URL to an authenticated session-suggests non-trivial exploitability. However, the authentication requirement (subscriber level minimum) and lack of any confirmed public exploit code or CISA KEV status indicate this is not currently a prioritized attack vector in the wild. The real danger emerges in multi-user WordPress installations or compromised accounts where attackers could map internal infrastructure, scan private IP ranges, or probe for unpatched internal services. Organizations should prioritize patching in internet-facing WordPress instances with user registration enabled, while lower-risk scenarios (hardened admin-only sites) can be deferred pending vendor guidance.

An attacker with a compromised WordPress subscriber account or authorized user registration on a target WordPress site uses the vulnerability to conduct internal network reconnaissance. The attacker crafts POST requests to the image crop functionality with the uwp_crop parameter set to URLs targeting internal services (such as http://192.168.1.1:8080 or http://internal-database.local:5432), forcing the WordPress server to perform outbound requests. By analyzing HTTP response times, error messages, or secondary exploitation vectors, the attacker maps the internal network, identifies running services, and potentially discovers credentials or sensitive information exposed by these services. No public proof-of-concept code is currently available, but the attack is straightforward to execute for any authenticated user with knowledge of the vulnerable parameter name.