CVE-2026-1356

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1356", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-22T19:44:35.120Z", "datePublished": "2026-02-12T09:25:49.034Z", "dateUpdated": "2026-04-08T16:37:38.490Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:38.490Z"}, "affected": [{"vendor": "mateuszgbiorczyk", "product": "Converter for Media \u2013 Optimize images | Convert WebP & AVIF", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Converter for Media \u2013 Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.5.1 via the PassthruLoader::load_image_source function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "title": "Converter for Media \u2013 Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/188d812c-2955-4b0c-ae1c-b42c0f60b73b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3445904/webp-converter-for-media"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 4.8, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Lucas Montes"}], "timeline": [{"time": "2026-01-22T20:16:13.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-11T21:24:23.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-12T14:19:51.556509Z", "id": "CVE-2026-1356", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T14:20:15.686Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1356", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T14:19:51.556509Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T14:20:06.520Z"}}], "cna": {"title": "Converter for Media \u2013 Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src", "credits": [{"lang": "en", "type": "finder", "value": "Lucas Montes"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "mateuszgbiorczyk", "product": "Converter for Media \u2013 Optimize images | Convert WebP & AVIF", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.5.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-22T20:16:13.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-11T21:24:23.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/188d812c-2955-4b0c-ae1c-b42c0f60b73b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3445904/webp-converter-for-media"}], "descriptions": [{"lang": "en", "value": "The Converter for Media \u2013 Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.5.1 via the PassthruLoader::load_image_source function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:38.490Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1356", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:37:38.490Z", "dateReserved": "2026-01-22T19:44:35.120Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-12T09:25:49.034Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Converter for Media \u2013 Optimize images | Convert WebP & AVIF", "vendor": "mateuszgbiorczyk", "versions": [{"lessThanOrEqual": "6.5.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Converter for Media \u2013 Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.5.1 via the PassthruLoader::load_image_source function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}, {"lang": "es", "value": "El plugin Converter for Media \u2013 Optimize images | Convert WebP &amp; AVIF para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor en todas las versiones hasta la 6.5.1, inclusive, a trav\u00e9s de la funci\u00f3n PassthruLoader::load_image_source. Esto hace posible que atacantes no autenticados realicen peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede utilizarse para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2026-1356", "lastModified": "2026-06-17T10:15:39.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1356", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-12T14:19:51.556509Z", "version": "2.0.3"}}]}, "published": "2026-02-12T10:16:01.517", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3445904/webp-converter-for-media"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/188d812c-2955-4b0c-ae1c-b42c0f60b73b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.5.1]"}}], "product": "converter_for_media_\u2013_optimize_images_|_convert_webp_&_avif", "vendor": "mateuszgbiorczyk"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:45:37.200902+00:00", "value": {"mitigation_remediation": ["Update the plugin to version 6.5.2 or later to remove the SSRF vulnerability.", "If an update is not immediately available, disable external URL loading in the plugin settings or patch the PassthruLoader::load_image_source function to enforce strict whitelist validation.", "Restrict outbound traffic from the WordPress server using firewall rules or web application firewall policies to block unsolicited requests to internal network addresses."], "summary": {"action": "Apply Patch", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed the Converter for Media \u2013 Optimize images | Convert WebP & AVIF plugin version 6.5.1 or earlier.", "description_and_impact": "The Converter for Media \u2013 Optimize images | Convert WebP & AVIF plugin processes external image URLs through the PassthruLoader::load_image_source function without validating or restricting destinations. This design flaw allows an unauthenticated attacker to instruct the web application to issue HTTP requests to arbitrary internal or external endpoints, enabling read or write operations against internal services. The resulting impact includes unauthorized data exposure, potential modification of internal resources, and broader access to the server\u2019s network without requiring user credentials.", "risk_and_exploitability": "The CVSS score of 4.8 indicates a moderate severity, while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, the flaw can be abused by unauthenticated actors who trigger the load function with a crafted source parameter, allowing them to send requests from the server to any reachable endpoint, including internal network services."}}}}, "created": "2026-02-12T11:19:11.155996+00:00", "updated": "2026-04-15T21:00:09.929689+00:00", "vendors": ["mateuszgbiorczyk", "mateuszgbiorczyk$PRODUCT$converter_for_media_\u2013_optimize_images_|_convert_webp_&_avif", "wordpress", "wordpress$PRODUCT$wordpress"]}