Smartaipress
Monthly
Full-read Server-Side Request Forgery in the SmartAIPress WordPress plugin (through version 1.2.0) allows any subscriber-level authenticated user to force the WordPress server to fetch arbitrary internal or external URLs and return the full response body. The vulnerability stems from a missing capability check on an AJAX action combined with zero server-side URL validation, making internal cloud metadata endpoints, intranet services, and private API surfaces reachable by low-privilege users. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited mass automated exploitation at time of analysis.
Full-read Server-Side Request Forgery in the SmartAIPress WordPress plugin (through version 1.2.0) allows any subscriber-level authenticated user to force the WordPress server to fetch arbitrary internal or external URLs and return the full response body. The vulnerability stems from a missing capability check on an AJAX action combined with zero server-side URL validation, making internal cloud metadata endpoints, intranet services, and private API surfaces reachable by low-privilege users. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited mass automated exploitation at time of analysis.