CVE-2026-105967: Security vulnerability

Published Nov 3, 2026

Updated

The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses.

Event History

Nov 3, 2026

CVE Published

via NVD·06:17 AM

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated attackers can exploit it, so no WordPress account or prior access is required.

What can an attacker do through the vulnerable plugin?

An attacker can supply a URL that causes the server to send requests to arbitrary internal hosts and return the responses. This can expose services or resources that are reachable from the WordPress server but not directly accessible from the internet.

Which plugin versions are affected?

Gallery for Social Photo WordPress plugin versions through 1.0.0.41 are affected.

CVE-2026-105967: Security vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do through the vulnerable plugin?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do through the vulnerable plugin?

Which plugin versions are affected?