CVE-2026-16600: SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image

Q: Who can exploit this issue?

Any authenticated WordPress user with subscriber-level access or higher can exploit it. The affected AJAX action lacks a capability check, so low-privileged accounts are sufficient.

Q: What access does an attacker need to perform the attack?

The attacker needs an authenticated account on the WordPress site and must be able to invoke the affected AJAX action. They can provide a URL for the server to fetch.

Q: What can an attacker obtain through the SSRF?

The issue allows the site to retrieve arbitrary internal or external URLs and return the fetched response to the attacker. This creates full-read SSRF exposure for resources reachable from the WordPress server.

Published Aug 29, 2026

Updated

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external URLs and read the response, resulting in a full-read Server-Side Request Forgery.

Affected Software

1 affected component

SmartAIPress WordPress plugin<=1.2.0

Event History

Aug 29, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with subscriber-level access or higher can exploit it. The affected AJAX action lacks a capability check, so low-privileged accounts are sufficient.

What access does an attacker need to perform the attack?

The attacker needs an authenticated account on the WordPress site and must be able to invoke the affected AJAX action. They can provide a URL for the server to fetch.

What can an attacker obtain through the SSRF?

The issue allows the site to retrieve arbitrary internal or external URLs and return the fetched response to the attacker. This creates full-read SSRF exposure for resources reachable from the WordPress server.

CVE-2026-16600: SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need to perform the attack?

What can an attacker obtain through the SSRF?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need to perform the attack?

What can an attacker obtain through the SSRF?