CVE-2026-27759: WordPress Featured Image SSRF Vulnerability

CVE-2026-27759 Overview

CVE-2026-27759 is an authenticated server-side request forgery (SSRF) vulnerability in the Featured Image from Content (featured-image-from-content) WordPress plugin. All versions prior to 1.7 are affected. The flaw allows Author-level authenticated users to coerce the WordPress server into fetching arbitrary internal HTTP resources. The plugin then writes the fetched content into web-accessible upload directories, turning the SSRF into a sensitive data exposure issue. The vulnerability is tracked under CWE-918 (Server-Side Request Forgery).

Critical Impact
Authenticated Author-level attackers can exfiltrate internal HTTP-accessible resources, including cloud metadata services and intranet endpoints, by forcing the WordPress server to fetch them and store responses in publicly readable upload paths.

Affected Products

Featured Image from Content WordPress plugin versions prior to 1.7
WordPress installations granting Author-level (or higher) accounts to untrusted users
Sites where the plugin's save_post URL-fetch handler is reachable

Discovery Timeline

2026-02-27 - CVE-2026-27759 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-27759

Vulnerability Analysis

The Featured Image from Content plugin automatically extracts an image URL from post content and stores it as the featured image. During the save_post workflow, the plugin issues an outbound HTTP request to the supplied URL and writes the response body to a file inside the WordPress uploads directory.

Because the URL is taken from user-controlled post content and is not restricted to image hosts or external addresses, an Author-level user can substitute any URL. The plugin follows the request and persists the result, enabling SSRF and information disclosure in a single chained operation.

The impact is bounded by the privilege requirement and by what the WordPress host can reach over HTTP. On cloud-hosted sites, reachable endpoints commonly include the instance metadata service, internal load balancers, and management APIs that trust requests originating from the application network.

Root Cause

The root cause is missing validation on the URL passed into the plugin's image-fetch routine. The handler does not enforce an allowlist of remote hosts, does not block private or link-local IP ranges, and does not verify that the response is an image before writing it to disk. This combination of unsafe outbound fetch and unsafe file write turns a feature into an SSRF primitive with persistent storage.

Attack Vector

An attacker first obtains or compromises an Author-level WordPress account. The attacker then creates or edits a post that embeds a crafted URL pointing to an internal resource such as http://169.254.169.254/latest/meta-data/ or an intranet service. When the post is saved, the plugin fetches the URL server-side and writes the response into the wp-content/uploads/ directory. The attacker retrieves the stored file directly over HTTP from the public uploads path, completing the exfiltration.

The vulnerability mechanism is documented in the VulnCheck advisory on the SSRF in save_post. No public proof-of-concept code has been released at the time of writing.

Detection Methods for CVE-2026-27759

Indicators of Compromise

Files in wp-content/uploads/ with non-image MIME types or content that resembles HTTP response bodies, JSON metadata, or HTML from internal hosts
Outbound HTTP requests from the WordPress server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or to 169.254.169.254
Recent save_post events from Author-level accounts followed immediately by new files in the uploads directory

Detection Strategies

Inspect the WordPress posts table for post_content containing URLs targeting internal hostnames or private address ranges
Correlate web server access logs for Author-level POSTs to wp-admin/post.php with subsequent outbound connections to non-public destinations
Hunt across endpoint and network telemetry for the PHP worker process initiating connections to cloud metadata endpoints

Monitoring Recommendations

Alert on any HTTP request from web-tier hosts to 169.254.169.254 or other instance metadata addresses
Track creation of files in wp-content/uploads/ whose extensions or magic bytes do not match recognized image formats
Review the plugin version inventory across managed WordPress sites and flag installations of featured-image-from-content below 1.7

How to Mitigate CVE-2026-27759

Immediate Actions Required

Upgrade Featured Image from Content to version 1.7 or later on every WordPress site where it is installed
Audit Author-level and higher accounts, remove unused accounts, and enforce strong authentication on remaining ones
Review the wp-content/uploads/ directory for unexpected files created since the plugin was installed and remove any that contain internal data

Patch Information

The maintainers released a fixed build in version 1.7 of the plugin. Update through the WordPress admin Plugins page or by replacing the plugin directory with the latest release from the official WordPress plugin page. Confirm the version string in the plugin header after deployment.

Workarounds

Deactivate the featured-image-from-content plugin until patching is possible
Restrict the WordPress host from initiating outbound HTTP requests to private address ranges and the cloud metadata service using egress firewall rules or IMDSv2 with hop-limit enforcement
Use a Web Application Firewall rule to block save_post requests whose payload contains URLs resolving to internal addresses
Limit Author-level role assignments to trusted users only

bash

# Example egress restriction using iptables on the WordPress host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j DROP