CVE-2026-1294: WordPress Image Viewer Block SSRF Flaw

CVE-2026-1294 Overview

The All In One Image Viewer Block plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 1.0.2. The vulnerability exists due to missing authorization and URL validation on the image-proxy REST API endpoint. This security flaw allows unauthenticated attackers to make arbitrary web requests originating from the web application server, potentially enabling them to query and modify information from internal services.

Critical Impact

Unauthenticated attackers can leverage this SSRF vulnerability to access internal network resources, potentially exposing sensitive data from backend services, cloud metadata endpoints, and other internal infrastructure not intended to be publicly accessible.

Affected Products

• All In One Image Viewer Block plugin for WordPress versions up to and including 1.0.2

Discovery Timeline

• 2026-02-05 - CVE-2026-1294 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-1294

Vulnerability Analysis

This SSRF vulnerability stems from the plugin's image-proxy REST API endpoint, which fails to implement proper authorization checks and URL validation. The endpoint was designed to proxy image requests, but the lack of security controls transforms it into an open proxy that can be weaponized by attackers.

When exploited, an attacker can craft requests that cause the WordPress server to make HTTP requests to arbitrary destinations. This includes internal network addresses (such as 127.0.0.1, localhost, or private IP ranges like 10.x.x.x, 172.16.x.x, and 192.168.x.x), cloud provider metadata endpoints, and other services that would normally be protected from external access. The vulnerability is particularly dangerous because it requires no authentication, meaning any internet-connected attacker can exploit it.

Root Cause

The root cause of this vulnerability is twofold: missing authorization checks on the REST API endpoint and insufficient URL validation. The image-proxy endpoint does not verify whether the requesting user has appropriate permissions to make proxy requests, and it does not validate or sanitize the target URL parameter to ensure it points only to legitimate external image resources. This allows attackers to specify arbitrary URLs, including those pointing to internal network resources. For technical details, refer to the WordPress Plugin Code Review.

Attack Vector

The attack vector is network-based and requires no user interaction or authentication. An attacker sends a crafted HTTP request to the vulnerable REST API endpoint with a malicious URL parameter pointing to an internal resource. The WordPress server then makes the request on behalf of the attacker, bypassing network segmentation and firewall rules that would normally prevent external access to internal services.

Common exploitation targets include:

• Cloud metadata endpoints (e.g., http://169.254.169.254/ for AWS, GCP, Azure)
• Internal web applications and administration interfaces
• Database services on internal networks
• Configuration management endpoints
• Other services listening on localhost

The vulnerability allows both reading sensitive information (via GET requests to internal services) and potentially modifying data if the internal services accept state-changing requests via the proxied connection.

Detection Methods for CVE-2026-1294

Indicators of Compromise

• Unusual outbound HTTP requests from the WordPress server to internal IP addresses (127.0.0.1, 10.x.x.x, 172.16.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints (169.254.169.254) originating from the web server
• High volume of requests to the /wp-json/ REST API endpoints related to the image viewer plugin
• Log entries showing access attempts to internal services from the WordPress application

Detection Strategies

• Monitor web server access logs for requests to the image-proxy REST API endpoint with suspicious URL parameters
• Implement network-level monitoring to detect outbound requests from the WordPress server to internal networks or metadata endpoints
• Deploy Web Application Firewall (WAF) rules to block requests containing internal IP addresses or cloud metadata URLs in parameters
• Use intrusion detection systems (IDS) to alert on SSRF patterns in HTTP traffic

Monitoring Recommendations

• Enable verbose logging for WordPress REST API endpoints
• Configure alerting for any outbound connections from the web server to private IP ranges
• Review web server logs regularly for anomalous proxy requests
• Implement network segmentation monitoring to detect lateral movement attempts

How to Mitigate CVE-2026-1294

Immediate Actions Required

• Update the All In One Image Viewer Block plugin to version 1.0.3 or later immediately
• If immediate update is not possible, deactivate and remove the plugin until patching can be completed
• Review server logs for evidence of exploitation attempts
• Audit any sensitive internal services that may have been accessed via SSRF

Patch Information

The vulnerability has been addressed in version 1.0.3 of the All In One Image Viewer Block plugin. The patch introduces proper URL validation and authorization checks on the image-proxy REST API endpoint. Administrators should update to version 1.0.3 or later through the WordPress plugin update mechanism or by manually downloading the updated plugin from the WordPress Plugin Repository. For details on the changes made, see the WordPress Changeset Update. Additional information is available in the Wordfence Vulnerability Report.

Workarounds

• Deactivate the All In One Image Viewer Block plugin until the update can be applied
• Implement WAF rules to block requests to the vulnerable endpoint containing internal IP addresses or metadata URLs
• Use network-level controls to prevent the web server from making outbound connections to internal networks
• Configure firewall rules to block access to cloud metadata endpoints from the WordPress server

# Example: Block internal IP ranges at the firewall level for outbound web server traffic
# This prevents SSRF attacks from reaching internal resources
iptables -A OUTPUT -p tcp -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -p tcp -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -p tcp -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -p tcp -d 169.254.169.254 -j DROP