PT-2026-21890 · WordPress · Responsive Lightbox & Gallery

Lukasz Sobanski · Published 2026-02-25 · Updated 2026-02-25 · CVE-2026-2479

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Responsive Lightbox & Gallery plugin for WordPress versions prior to 2.7.2

Description The software is susceptible to Server-Side Request Forgery. This is caused by using strpos() for hostname validation instead of strict host comparison within the ajax upload image() function. Authenticated attackers with Author-level access or higher can make web requests to arbitrary locations from the web application, potentially allowing them to query and modify information from internal services.

Recommendations Update the Responsive Lightbox & Gallery plugin to version 2.7.2 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-2479

Affected Products

Responsive Lightbox & Gallery

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-2479 · Security Note
• https://plugins.trac.wordpress.org/browser/responsive-lightbox/trunk/includes/class-remote-library.php#L329 · Note
• https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.7.0/includes/class-remote-library.php#L329 · Note
• https://t.me/cveNotify/153128 · Telegram Post
• https://t.me/CVEtracker/45716 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/44276b28-9509-4f59-936c-fff2ae404076?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3464566?contextall=1 · Note
• https://twitter.com/CVEnew/status/2026641322472313055 · Twitter Post
• https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.7.0/includes/class-remote-library.php#L344 · Note