CVE-2026-1356 Overview
CVE-2026-1356 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress. The flaw affects all plugin versions up to and including 6.5.1 and resides in the PassthruLoader::load_image_source function. Unauthenticated attackers can leverage the vulnerable function to issue arbitrary web requests originating from the WordPress server. This enables attackers to query and modify information exposed by internal services that are otherwise unreachable from the public internet.
Critical Impact
Unauthenticated attackers can pivot through the WordPress server to interact with internal network services, cloud metadata endpoints, and other resources protected by network boundaries.
Affected Products
- Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress (all versions through 6.5.1)
- WordPress installations with the vulnerable plugin enabled
- Hosting environments exposing internal services reachable from the WordPress host
Discovery Timeline
- 2026-02-12 - CVE-2026-1356 published to the National Vulnerability Database
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-1356
Vulnerability Analysis
The vulnerability resides in the PassthruLoader::load_image_source function within the Converter for Media plugin. The function accepts a remote image source and fetches it server-side without sufficient validation of the destination URL. Because the request originates from the WordPress server, attackers can reach hosts and ports that network controls otherwise shield from external clients.
An attacker can supply URLs targeting 127.0.0.1, RFC1918 ranges, or cloud provider metadata services such as http://169.254.169.254/. The plugin then issues the request and may return or process the response. This grants the attacker a primitive for internal network reconnaissance, interaction with unauthenticated internal APIs, and potential modification of state in services that trust requests originating from the local host.
Exploitation requires no authentication. The attack complexity is elevated because successful exploitation depends on the presence of reachable internal services and on attacker knowledge of internal endpoints.
Root Cause
The root cause is missing validation and allow-listing of user-supplied URLs passed to PassthruLoader::load_image_source. The function does not restrict destination hosts, schemes, or IP ranges before performing the outbound HTTP request, satisfying the conditions described in [CWE-918].
Attack Vector
The attack vector is network-based. An unauthenticated remote attacker sends a crafted HTTP request to the WordPress endpoint exposing the loader. The plugin then issues a server-originated request to the attacker-controlled target URL. Refer to the WordPress Plugin Update and the Wordfence Vulnerability Report for technical specifics.
Detection Methods for CVE-2026-1356
Indicators of Compromise
- Outbound HTTP requests from the WordPress host targeting 127.0.0.1, localhost, RFC1918 addresses, or 169.254.169.254.
- Web server access logs showing repeated requests to the Converter for Media plugin endpoints with URL parameters pointing to internal hosts.
- Unexpected User-Agent strings associated with the plugin's HTTP client reaching internal services.
Detection Strategies
- Inspect WordPress access logs for requests invoking the Converter for Media plugin with attacker-controlled URL parameters.
- Correlate plugin-originated outbound traffic with destinations that fall inside private IP ranges or cloud metadata endpoints.
- Alert on responses from cloud instance metadata services returning credential material to the WordPress host.
Monitoring Recommendations
- Enable egress logging from WordPress hosts and forward records to a centralized analytics platform for retrospective hunting.
- Monitor plugin file integrity and version state across managed WordPress fleets.
- Track web application firewall rules for SSRF signatures and tune alerts on plugin-specific endpoints.
How to Mitigate CVE-2026-1356
Immediate Actions Required
- Update the Converter for Media plugin to a version newer than 6.5.1 on all WordPress installations.
- Audit hosting environments for exposed internal services accessible from the WordPress host and restrict them with network controls.
- Block outbound requests from web application hosts to cloud metadata endpoints unless explicitly required.
Patch Information
The plugin vendor remediated the issue in the changeset published at the WordPress Plugin Update. Administrators should apply the update through the WordPress plugin manager or via WP-CLI. Confirm the installed version exceeds 6.5.1 post-update.
Workarounds
- Disable the Converter for Media plugin until the patched version is installed.
- Apply web application firewall rules that block requests to plugin endpoints containing internal IP literals or non-HTTP schemes.
- Enforce egress filtering that denies WordPress hosts from reaching 169.254.169.254 and private network ranges.
# Configuration example: restrict outbound access from WordPress host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
