PT-2026-21890 · WordPress · Responsive Lightbox & Gallery

Lukasz Sobanski · Publicado 2026-02-25 · Atualizado 2026-02-25 · CVE-2026-2479

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Responsive Lightbox & Gallery plugin for WordPress versions prior to 2.7.2

Description The software is susceptible to Server-Side Request Forgery. This is caused by using strpos() for hostname validation instead of strict host comparison within the ajax upload image() function. Authenticated attackers with Author-level access or higher can make web requests to arbitrary locations from the web application, potentially allowing them to query and modify information from internal services.

Recommendations Update the Responsive Lightbox & Gallery plugin to version 2.7.2 or later.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-2479

Produtos afetados

Responsive Lightbox & Gallery

Referências · 9

• https://plugins.trac.wordpress.org/browser/responsive-lightbox/trunk/includes/class-remote-library.php#L329 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2479 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.7.0/includes/class-remote-library.php#L329 · Nota
• https://t.me/cveNotify/153128 · Publicação no Telegram
• https://t.me/CVEtracker/45716 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/44276b28-9509-4f59-936c-fff2ae404076?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset/3464566?contextall=1 · Nota
• https://twitter.com/CVEnew/status/2026641322472313055 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.7.0/includes/class-remote-library.php#L344 · Nota