PT-2025-26353 · Unknown · Ali Irani Auto Upload Images

Ch4R0N · Published 2025-06-20 · Updated 2025-06-20 · CVE-2025-49985

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Ali Irani Auto Upload Images versions 3.3.2 and earlier

Description: The issue is a Server-Side Request Forgery (SSRF) vulnerability that allows Server Side Request Forgery. This means an attacker can potentially force the server to make requests to arbitrary domains, which could lead to unauthorized access or data leakage.

Recommendations: For Ali Irani Auto Upload Images versions 3.3.2 and earlier, update to a version that fixes the SSRF vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-49985

Affected Products

Ali Irani Auto Upload Images

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-49985 · Security Note
• https://twitter.com/CVEnew/status/1936103907941314840 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/auto-upload-images/vulnerability/wordpress-auto-upload-images-plugin-3-3-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/auto-upload-images/vulnerability/wordpress-auto-upload-images-plugin-3-3-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1936097342794695149 · Twitter Post