PT-2026-22410 · WordPress · Featured Image From Content Wordpress Plugin

4Lec4St · Publicado 2026-02-27 · Atualizado 2026-02-28 · CVE-2026-27759

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Featured Image from Content WordPress plugin versions prior to 1.7

Description The Featured Image from Content WordPress plugin has a server-side request forgery issue. Users with Author-level access can retrieve internal HTTP resources. This is due to insecure URL fetching and file write operations, which allow attackers to obtain sensitive internal data and save it to publicly accessible upload directories.

Recommendations Update to Featured Image from Content WordPress plugin version 1.7 or later.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-27759

Produtos afetados

Featured Image From Content Wordpress Plugin

Referências · 6

• https://vulncheck.com/advisories/featured-image-from-content-authenticated-ssrf-via-save-post · Nota
• https://twitter.com/CVEnew/status/2027744209583624611 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27759 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2027556619320451274 · Publicação no Twitter
• https://t.me/CVEtracker/46033 · Publicação no Telegram
• https://wordpress.org/plugins/featured-image-from-content · Correção