CVE-2026-32467: Aotuman Grab WeChat Articles SSRF Flaw

CVE-2026-32467 Overview

CVE-2026-32467 is a Server-Side Request Forgery (SSRF) vulnerability in the Aotuman Grab WeChat Articles WordPress plugin (apoyl-grabweixin) affecting versions 2.0.1 and earlier. The flaw allows an authenticated attacker with Subscriber-level privileges to coerce the WordPress server into issuing arbitrary HTTP requests to attacker-chosen destinations. The vulnerability maps to CWE-918: Server-Side Request Forgery. Because the requests originate from the server, attackers can reach internal services and cloud metadata endpoints that are otherwise unreachable from the internet.

Critical Impact
An authenticated Subscriber can pivot through the WordPress server to probe internal networks, access cloud metadata services, and interact with services shielded by network segmentation.

Affected Products

Aotuman Grab WeChat Articles WordPress plugin (apoyl-grabweixin) versions up to and including 2.0.1
WordPress sites permitting Subscriber-level registration with the plugin installed
Deployments hosting the plugin on cloud instances with reachable metadata endpoints

Discovery Timeline

2026-08-18 - CVE-2026-32467 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-32467

Vulnerability Analysis

The Grab WeChat Articles plugin exposes functionality that fetches remote content, presumably to import WeChat articles into a WordPress site. The plugin accepts a user-controlled URL parameter and passes it to a server-side HTTP fetch routine without adequate validation of scheme, host, or destination address range. An attacker holding a low-privilege Subscriber account can invoke this functionality and substitute the intended external URL with an internal target.

Exploitation requires authentication, but Subscriber accounts are trivially obtained on WordPress sites that allow open registration. The Common Vulnerability Scoring System vector notes a changed scope, reflecting that the impacted resource (internal service or metadata endpoint) is distinct from the vulnerable component (WordPress plugin).

Root Cause

The root cause is missing validation of the destination URL before the plugin performs a server-side HTTP request. The code path does not restrict requests to allowed hostnames, block private and link-local IP ranges (RFC 1918, 169.254.0.0/16), or filter non-HTTP schemes. Without these controls, the fetch function will resolve and connect to any address supplied by the caller.

Attack Vector

An attacker registers or acquires a Subscriber account on the target site. The attacker then issues an authenticated request to the vulnerable plugin endpoint, supplying an internal URL such as http://127.0.0.1:8080/, http://169.254.169.254/latest/meta-data/, or an intranet host. The WordPress server dispatches the request and returns response data, response headers, or timing signals that the attacker uses to enumerate internal services and, in cloud environments, potentially harvest instance credentials.

No verified proof-of-concept code has been published. Refer to the Patchstack SSRF Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2026-32467

Indicators of Compromise

Outbound HTTP requests from the WordPress host to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local addresses (169.254.169.254)
Web server access logs showing authenticated Subscriber accounts calling apoyl-grabweixin plugin endpoints with URL parameters pointing to non-WeChat domains
Unexpected connections from PHP worker processes to loopback ports or cloud metadata services

Detection Strategies

Alert on any egress traffic from the WordPress server destined for private, loopback, or metadata IP ranges
Inspect WordPress request logs for admin-ajax.php or REST calls invoking the plugin with URL query parameters that do not match the weixin.qq.com domain
Correlate newly registered Subscriber accounts with subsequent invocations of the plugin fetch action within short time windows

Monitoring Recommendations

Enable verbose logging on the reverse proxy and PHP-FPM layers to capture full request URIs and originating user IDs
Instrument outbound DNS resolutions from the web tier and flag lookups for metadata.google.internal, 169.254.169.254, or internal-only hostnames
Deploy runtime file and process monitoring on the WordPress host to detect follow-on activity such as credential exfiltration or shell spawn attempts

How to Mitigate CVE-2026-32467

Immediate Actions Required

Update the Aotuman Grab WeChat Articles plugin to a version above 2.0.1 once released, or deactivate and delete the plugin if no fixed version is available
Disable open Subscriber registration on sites where the plugin remains active by setting Anyone can register to off in WordPress General Settings
Audit existing Subscriber accounts and remove unrecognized users

Patch Information

As of the last modification date, the Patchstack advisory tracks affected versions at 2.0.1 and below. Site administrators should monitor the WordPress plugin repository for an updated release and apply it promptly. In the absence of an official patch, plugin removal is the recommended remediation.

Workarounds

Restrict outbound network egress from the WordPress server using host-based firewall rules that deny connections to RFC 1918, loopback, and 169.254.169.254 destinations
Enforce Instance Metadata Service Version 2 (IMDSv2) on AWS EC2 instances to require session tokens and defeat basic SSRF metadata harvesting
Place a Web Application Firewall rule in front of the plugin endpoint that rejects requests containing URL parameters resolving to private address space
Remove the plugin directory from the WordPress installation if it is not actively required

bash

# Configuration example: block SSRF egress from the WordPress host to metadata and private ranges
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT

# Disable open registration in wp-config.php enforcement
wp option update users_can_register 0