CVE-2026-127217: Post to Google My Business WordPress Plugin < 3.5.7 SSRF via Preview REST Route

Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability that allows authenticated users with Contributor-level privileges or higher to make the server send requests to arbitrary hosts by supplying an unvalidated mbppostattachment URL that reaches a raw getimagesize() call in validateexternalimagesize() via the preview REST route. Attackers can exploit this to perform internal port scanning, probe internal-only services and cloud metadata endpoints, and trigger GET-based side effects on internal systems, bypassing network perimeter controls since the request originates from the web server.