CVE-2026-1356: WordPress Converter for Media SSRF Vulnerability

CVE-2026-1356 Overview

The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 6.5.1. The vulnerability exists in the PassthruLoader::load_image_source function, which fails to properly validate user-supplied URLs before making server-side requests. This allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application, potentially enabling them to query and modify information from internal services.

Critical Impact

Unauthenticated attackers can leverage this SSRF vulnerability to access internal network resources, potentially exposing sensitive data from internal services or bypassing firewall restrictions to interact with backend systems.

Affected Products

• Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress versions ≤ 6.5.1
• WordPress installations running the vulnerable plugin versions

Discovery Timeline

• February 12, 2026 - CVE-2026-1356 published to NVD
• February 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1356

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability (CWE-918) resides in the image loading functionality of the WordPress plugin. The PassthruLoader::load_image_source function processes image URLs without adequate validation of the destination, allowing attackers to manipulate the server into making requests to arbitrary internal or external endpoints.

SSRF vulnerabilities are particularly dangerous in cloud environments where instance metadata services may be accessible. An attacker could potentially access cloud provider metadata endpoints (such as http://169.254.169.254/) to retrieve sensitive credentials or configuration data. Additionally, the vulnerability can be used to scan internal network resources, interact with internal APIs, or bypass network security controls that trust requests originating from the web server.

Root Cause

The root cause of this vulnerability is insufficient URL validation in the PassthruLoader::load_image_source function. The function accepts user-controlled input for image source URLs and processes them without properly validating whether the target destination is an authorized external resource. This lack of input sanitization allows attackers to specify arbitrary URLs, including those pointing to internal network addresses, localhost services, or cloud metadata endpoints.

Attack Vector

The attack can be executed remotely over the network without authentication. An attacker crafts malicious requests to the vulnerable endpoint, supplying URLs that point to internal resources instead of legitimate image sources. The server then makes requests on behalf of the attacker, returning the response data or enabling interaction with internal services.

The vulnerability enables attackers to probe internal network infrastructure, access internal services that are not exposed to the internet, and potentially exfiltrate sensitive data from cloud metadata services or internal APIs. The attack requires no user interaction and can be automated for reconnaissance or data extraction purposes.

Detection Methods for CVE-2026-1356

Indicators of Compromise

• Unusual outbound HTTP requests from the WordPress server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Web server logs showing requests to the plugin endpoints with suspicious URL parameters containing internal addresses or localhost references
• Requests targeting cloud metadata endpoints such as 169.254.169.254 originating from the web application
• Unexpected network connections from the web server to services it doesn't normally communicate with

Detection Strategies

• Configure web application firewalls (WAF) to detect and block SSRF attack patterns in request parameters
• Implement network-level monitoring to flag outbound connections from web servers to internal network ranges
• Review WordPress access logs for requests to the Converter for Media plugin endpoints containing unusual URL parameters
• Deploy SentinelOne Singularity Platform to detect anomalous network behavior from web application processes

Monitoring Recommendations

• Enable detailed logging for the WordPress installation and monitor for suspicious plugin activity
• Configure egress filtering alerts to detect when the web server attempts connections to internal resources
• Implement rate limiting on the affected plugin endpoints to detect potential automated exploitation attempts
• Use SentinelOne's behavioral AI to identify unusual process network activity indicative of SSRF exploitation

How to Mitigate CVE-2026-1356

Immediate Actions Required

• Update the Converter for Media plugin to a version newer than 6.5.1 immediately
• Review server logs for signs of exploitation, particularly outbound requests to internal network addresses
• Implement network segmentation to limit the web server's ability to access sensitive internal services
• Configure egress filtering to restrict outbound connections from the WordPress server to only necessary external resources

Patch Information

A security patch addressing this vulnerability is available. The fix can be reviewed in the WordPress Plugin Change Log. Update the plugin through the WordPress admin dashboard or by manually downloading and installing the patched version from the WordPress plugin repository.

Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the Converter for Media plugin until the patch can be applied
• Implement WAF rules to block requests containing internal IP addresses or localhost in URL parameters to the affected endpoints
• Configure network-level egress filtering to prevent the web server from accessing internal network resources and cloud metadata endpoints
• Use a reverse proxy to validate and sanitize all incoming requests to the WordPress installation

# Example: Block access to internal IPs via iptables (temporary mitigation)
# Prevent web server from connecting to common internal ranges
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j DROP